MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adb65085d8fc39b9d62da39e9d81e52cf4dc2a5a37bf95ffd0cde4f8bab19f6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: adb65085d8fc39b9d62da39e9d81e52cf4dc2a5a37bf95ffd0cde4f8bab19f6a
SHA3-384 hash: 22a88008b4f56ed7d77e2445e5d63b98c17558df2cc05d62d7ad21901f49e64a0b6f64a46a4d4158d0d0a17a1988c59b
SHA1 hash: 31212ce376b76bd29183a25f517e2f7d5af6482f
MD5 hash: 35e38455800ab166d35009a273251c76
humanhash: jig-beer-robert-zulu
File name:Quotation 6000000001863_pdf.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:713'299 bytes
First seen:2022-07-13 07:05:54 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:tUsLgbU5S80YKOKyC1LyNf0uxknos3WER3+aJ4G6wRjnwJInjYgu10TNWGcD:tUsLyO10Y7KyC12dkoyWeZuGzm2jYL1V
TLSH T1A5E423AA09EA94D1C47BDD4568C59CAAD0D8F16C4CBD6123528903ECB8EBB073DBD47C
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook gz QUOTATION


Avatar
cocaman
Malicious email (T1566.001)
From: "Keerthana<support@behbehani.com.bh>" (likely spoofed)
Received: "from behbehani.com.bh (unknown [185.222.58.69]) "
Date: "12 Jul 2022 14:01:52 +0200"
Subject: "Request for quote - BW CLip - 12 July 2022"
Attachment: "Quotation 6000000001863_pdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/adb65085d8fc39b9d62da39e9d81e52cf4dc2a5a37bf95ffd0cde4f8bab19f6a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-07-12 08:23:43 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
22 of 40 (55.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vw3fbboy7q43tvrnuopj3apfft2nyks2g67zl76qzxsprovrt5va._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ir93 rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220713-hw3gysbcaq/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Formbook payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/adb65085d8fc39b9d62da39e9d81e52cf4dc2a5a37bf95ffd0cde4f8bab19f6a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz adb65085d8fc39b9d62da39e9d81e52cf4dc2a5a37bf95ffd0cde4f8bab19f6a

(this sample)

Formbook

Executable exe 9bccba2dd88df736c04d6d657879abe5b3bee28103aecedbba19b91b684d43af

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9bccba2dd88df736c04d6d657879abe5b3bee28103aecedbba19b91b684d43af
  
Dropping
Formbook

Comments