MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91ced8ae239b6f99a6b15217769d96e5ebf2b2575dd9b9a3e1abd4269133a7cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91ced8ae239b6f99a6b15217769d96e5ebf2b2575dd9b9a3e1abd4269133a7cb
SHA3-384 hash: 4df2ddd10801fd36997b6dd19d6c984fb163f89dd4b24a838d1e3e29f969aad321e405d3066e3f58ebdcbf3fd23d02c5
SHA1 hash: 2fb093f1e638678f19d01b959eebfc14e268aaaa
MD5 hash: 7910c610f01178980eb3b77f43a146cc
humanhash: island-skylark-illinois-lamp
File name:wire swift copy.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:750'557 bytes
First seen:2022-03-23 12:09:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:1d7jQW3z/K1vyPElAYDXNTPRcWhc/mjf7K+CfIbARUaOYxztjNxMRiq:1d7cS4tPRtQmjG+CyARUaOYxtNxMRp
TLSH T1ADF423AAFA17B32E4A0F243134FBF75A046A9EAE50E50F595E3494189747046FF28CC6
Reporter cocaman
Tags:FormBook SWIFT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "George Irving <statement@fmg.co.nz>" (likely spoofed)
Received: "from nhmail.jcihosting.net (nhmail.jcihosting.net [69.55.235.152]) "
Date: "Wed, 23 Mar 2022 06:59:50 +0100"
Subject: "Re: Confirm Remittance of payment"
Attachment: "wire swift copy.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn112.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/623b0eaa0cd58dbd92df1d55/reports/878f828c-1aeb-448e-95ba-fa3131b5f5ef/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/91ced8ae239b6f99a6b15217769d96e5ebf2b2575dd9b9a3e1abd4269133a7cb
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91ced8ae239b6f99a6b15217769d96e5ebf2b2575dd9b9a3e1abd4269133a7cb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 10:34:37 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
15 of 42 (35.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=shhnrlrdtnxztjvrkilxnhmw4xv7fmsxlxm3ti7bvpkcnejtu7fq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:oto8 rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220323-pb8a2aabar/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/91ced8ae239b6f99a6b15217769d96e5ebf2b2575dd9b9a3e1abd4269133a7cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 91ced8ae239b6f99a6b15217769d96e5ebf2b2575dd9b9a3e1abd4269133a7cb

(this sample)

Formbook

Executable exe 7f0e1d1ec3cedb0f7855a4d8a7b2fb3905c58c999604162fc669ca4aa361dd70

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f0e1d1ec3cedb0f7855a4d8a7b2fb3905c58c999604162fc669ca4aa361dd70

Comments