MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8488c26ef141a60e4723754a2992b7025ac452d8a7df86d40fd72bd2b2e7268b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8488c26ef141a60e4723754a2992b7025ac452d8a7df86d40fd72bd2b2e7268b
SHA3-384 hash: c41bf2a04767e9a1048604be86621d65d2bb66e5ac7224279198860a09f2eb6906a96f5de3f6eb80ba2836e33d373a61
SHA1 hash: 3e8b4fa6a6ed75fe57eb9a1c56e87f7774d90bdf
MD5 hash: ca7e1873d9996884a2e5e85ea8104b90
humanhash: red-golf-emma-tango
File name:INVOICE 60019358720.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:649'613 bytes
First seen:2024-06-20 14:24:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:F0nX2rL53o4ymDvSaB1J6ON8CRVTqiUR5c36CcVin8FKnQLhobkU:FcX2B3oBmDb7NHFc5blKnQl8
TLSH T172D423A50B05D4F36D733843809061E1F56C8FFAABA35EC9A677C1AD827CCACBD19950
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook INVOICE rar


Avatar
cocaman
Malicious email (T1566.001)
From: "acct@ae.cpworldgroup.com" (likely spoofed)
Received: "from j2se-extendrd.naturescar.com (unknown [185.222.58.55]) "
Date: "20 Jun 2024 10:47:33 +0200"
Subject: "Pending statement of account--JUNE 2024"
Attachment: "INVOICE 60019358720.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:INVOICE 60019358720.exe
File size:677'888 bytes
SHA256 hash: f6a3a015f35a4e3a6c33c51b9368c66b6dae0331f8cea6a53a87edd429968481
MD5 hash: 1a01a7206f57dff164d800fcf2c58e00
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/66743bc06b8dba248b434bcb/reports/1fede5ba-a14d-439a-a12d-29b07ff8a306/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8488c26ef141a60e4723754a2992b7025ac452d8a7df86d40fd72bd2b2e7268b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8488c26ef141a60e4723754a2992b7025ac452d8a7df86d40fd72bd2b2e7268b/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2024-06-20 11:40:01 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qseme3xrigta4rzdovfctevxajnmiuwyu7pynvap24v5fmxhe2fq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240620-rvpzxawgqk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8488c26ef141a60e4723754a2992b7025ac452d8a7df86d40fd72bd2b2e7268b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 8488c26ef141a60e4723754a2992b7025ac452d8a7df86d40fd72bd2b2e7268b

(this sample)

Formbook

Executable exe f6a3a015f35a4e3a6c33c51b9368c66b6dae0331f8cea6a53a87edd429968481

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f6a3a015f35a4e3a6c33c51b9368c66b6dae0331f8cea6a53a87edd429968481
  
Dropping
MD5 1a01a7206f57dff164d800fcf2c58e00

Comments