MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a03371c0ffc63a6acb4b6db3d5523e013c0b59691b38fbda1e4541f02347928e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a03371c0ffc63a6acb4b6db3d5523e013c0b59691b38fbda1e4541f02347928e
SHA3-384 hash: ade17d82a4ee2e8f1d9dc2d618df13ea9516b6828e20e2746760c191642c3ad350f684422505c0283e5f0d84d147313f
SHA1 hash: b4ca4546ddb02bcaa72de1debf8b4c84283f7a5a
MD5 hash: 89a356776ccb3e052108b1906e97fb4d
humanhash: football-undress-angel-montana
File name:Payment Advice.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:214'724 bytes
First seen:2022-05-18 13:55:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:tBaUzJrwo45PxMB9ieA19uAZ2OooHSvGXl7:tl8Pu3A19XfooHS+X1
TLSH T1AC24120DE1E2B53C388F89F18474B9DD3B9663E94C1694A98E711EB9CB44E62C81235F
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook payment rar


Avatar
cocaman
Malicious email (T1566.001)
From: "account <admin@mjengineering-inc.solutions>" (likely spoofed)
Received: "from 23-227-168-130.static.hvvc.us (23-227-168-130.static.hvvc.us [23.227.168.130]) "
Date: "18 May 2022 06:16:55 -0700"
Subject: "Re: Advance TT Copy "
Attachment: "Payment Advice.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a03371c0ffc63a6acb4b6db3d5523e013c0b59691b38fbda1e4541f02347928e/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-05-18 09:29:23 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
14 of 41 (34.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uazxdqh7yy5gvs2lnwz5kur6ae6awwljdm4pxwq6iva7ai2hskha._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:r75h rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220518-q8ntbsaee5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a03371c0ffc63a6acb4b6db3d5523e013c0b59691b38fbda1e4541f02347928e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a03371c0ffc63a6acb4b6db3d5523e013c0b59691b38fbda1e4541f02347928e

(this sample)

Formbook

Executable exe 51ab17fdd212d1bae66a6ec70e44b220f02a33a7e0a2785c6e69f421d79d4cdb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 51ab17fdd212d1bae66a6ec70e44b220f02a33a7e0a2785c6e69f421d79d4cdb
  
Dropping
MD5 c43e1fb14a30c0e7b3040c94d16a196c

Comments