MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2a222b2146dbfd67dcf75786faa5815ad07f3067a3e6cf9decb2c57601e4e8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2a222b2146dbfd67dcf75786faa5815ad07f3067a3e6cf9decb2c57601e4e8b
SHA3-384 hash: c49bd9d69e9f6bd5ff5f80d91144e0b8efab46586869b84229dfaf01b4bc6eb2e3d09532893582a37d31076e5cfadc29
SHA1 hash: 75a43fcf38a11abfd53c2e6ce659a68cf0bc55b3
MD5 hash: 787e8a049f5d1491e3c6b1f401fe3aaa
humanhash: mockingbird-earth-missouri-stream
File name:ORDER.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:597'472 bytes
First seen:2022-05-09 06:13:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wx8vGx4DNpOISs/eeTTL2nTR2x6Vl6GUZC6v0KxNvuq5I:hvG6DNIyeeHL2nTR2g7m86v08Ruq5I
TLSH T18DD42359DCE8614124DAFA3D3D5ACF980075A23AF4716631835DE27BE8CB3880FE991D
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email (T1566.001)
From: "<H. E. Bluhmes>info@zipcar.com" (likely spoofed)
Received: "from brotherstrading.com.pk (unknown [212.193.30.204]) "
Date: "08 May 2022 16:40:52 -0700"
Subject: "RE:ORDER"
Attachment: "ORDER.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.W32.AIDetectNet.01.4827.10302.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/6278b140be0219041a8661b4/reports/c5b0f09e-852b-418e-bd66-47096e868d28/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b2a222b2146dbfd67dcf75786faa5815ad07f3067a3e6cf9decb2c57601e4e8b
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2a222b2146dbfd67dcf75786faa5815ad07f3067a3e6cf9decb2c57601e4e8b/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2022-05-09 01:43:17 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
19 of 41 (46.34%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wkrcfmqunw75m7opov4g7ksycwwqp4ygpi7gz6o6zmwfoya6j2fq._file
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger spyware stealer suricata trojan
Link:
https://tria.ge/reports/220509-gzbb7scdg7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
suricata: ET MALWARE Possible NanoCore C2 60B
Malware Config
C2 Extraction:
deranano2.ddns.net:1187
194.31.178:1187
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2a222b2146dbfd67dcf75786faa5815ad07f3067a3e6cf9decb2c57601e4e8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip b2a222b2146dbfd67dcf75786faa5815ad07f3067a3e6cf9decb2c57601e4e8b

(this sample)

Formbook

Executable exe 46864364581f4a18b628a1b68bfe231d72f4f871eaa712c1c3150cb01c65e6bc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46864364581f4a18b628a1b68bfe231d72f4f871eaa712c1c3150cb01c65e6bc
  
Dropping
Formbook

Comments