MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 be6bbf6ffbea93e6176181235db4540909a6a02c985b21a633c01a19617f04fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 6
| SHA256 hash: | be6bbf6ffbea93e6176181235db4540909a6a02c985b21a633c01a19617f04fa |
|---|---|
| SHA3-384 hash: | 4ce6b1b1020421d494b1bb75e97f403c4894c55f66bc35cfbc9a13a16548678f265f4f6cddf809267048f6d0c3695f0b |
| SHA1 hash: | 3a45fd2199523bd08b6998c4c6f4b112268e9c8a |
| MD5 hash: | 6622ea3299728065221dfd7e18105248 |
| humanhash: | idaho-hydrogen-island-bacon |
| File name: | ADOC RFQ-WCMS-1800865.zip |
| Download: | download sample |
| Signature | Formbook |
| File size: | 20'351 bytes |
| First seen: | 2022-05-09 08:28:37 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 384:Lu8nFPKl3E99rTI4stWTOP/OLVj0f0IznXM7q/8d0NKhOKOcyEogwjzH6zIYB:L1S3+9rszWTeW540OXM7NhOlcynlbzYB |
| TLSH | T16092D0B78B0D8B6CCD621B36084CB5CB727766811E5E56320BE810751F829ED38A5E7B |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  cocaman |
| Tags: | FormBook RFQ zip |
cocaman
Malicious email (T1566.001)From: "Safdar Hashmi <info@adoc.ae>" (likely spoofed)
Received: "from [172.93.184.57] (unknown [172.93.184.57]) "
Date: "9 May 2022 09:21:34 +0200"
Subject: "ADOC RFQ-WCMS-1800865"
Attachment: "ADOC RFQ-WCMS-1800865.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
222
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Spyware.Noon
Status:
Malicious
First seen:
2022-05-09 08:29:08 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
9 of 42 (21.43%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:fk84 loader rat suricata
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.