MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be712d13c9298e5c7d627501bd7e16c9518d20e5b152dbc73e255ff4945534da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be712d13c9298e5c7d627501bd7e16c9518d20e5b152dbc73e255ff4945534da
SHA3-384 hash: 2583cd1d21858757f65b928d0015de0f80b65dfbf75502fc5ad469d80e2d65b3962ecf5ba3261e71616fe5a9122c9ed1
SHA1 hash: 382b24af40a25a65f653b4a8de6366f297e4f32b
MD5 hash: 1d1c47aa5439bb1bc418d8182ed2e195
humanhash: seventeen-lemon-undress-november
File name:X09876543234567890987654.LZH
Download: download sample
Signature Formbook
Create hunting rule
File size:409'827 bytes
First seen:2022-03-14 07:16:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:lgzHp0rAP1dXb90up05npl/d9ubNkvAVdTb8vCAlT0zyq/sTDc0HCfC0i:lFrOJqdnpdddv45b8vH0+Dc0iNi
TLSH T14B942337BB2F6886A21DBE42654C54B36E825F35E1D09C0AF91093D6C375C2B30572EE
Reporter cocaman
Tags:FormBook INVOICE lzh zip


Avatar
cocaman
Malicious email (T1566.001)
From: "arcodesarrolladora@hotmail.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.57.217]) "
Date: "14 Mar 2022 02:27:49 +0100"
Subject: "Re: INVOICE PENDING PAYMENT"
Attachment: "X09876543234567890987654.LZH"

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48175.26835.4533.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe formbook overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/622eebf10cd58dbd9294881b/reports/54d59dbc-3407-4d54-8330-5c08f9a2436b/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/be712d13c9298e5c7d627501bd7e16c9518d20e5b152dbc73e255ff4945534da
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be712d13c9298e5c7d627501bd7e16c9518d20e5b152dbc73e255ff4945534da/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-14 04:53:08 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
13 of 42 (30.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzys2e6jfghfy7lcoua327qwzfiy2ihfwfjnxrz6evp7jfcvgtna._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:pot0 loader rat suricata
Link:
https://tria.ge/reports/220314-h4c72affhp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.18
Link:
https://yomi.yoroi.company/submissions/be712d13c9298e5c7d627501bd7e16c9518d20e5b152dbc73e255ff4945534da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip be712d13c9298e5c7d627501bd7e16c9518d20e5b152dbc73e255ff4945534da

(this sample)

Formbook

Executable exe b14cfba125a0fd02139064d326e1b32bddff5d1ae0e50fff24bc4f9a2f9e1732

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b14cfba125a0fd02139064d326e1b32bddff5d1ae0e50fff24bc4f9a2f9e1732

Comments