MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf76a4636fbe2a304c8bd441e1e06118932ccb411f7323c6e5e2dde1a952eee2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf76a4636fbe2a304c8bd441e1e06118932ccb411f7323c6e5e2dde1a952eee2
SHA3-384 hash: 08f984545dbf50886adfdc50bc146f287f047bed805b6756d8d5848a147b8ec7315f977c2452776f87f70403db95b30a
SHA1 hash: 5d88456925a5b4efe5b57ecf67ee03e62cadadd1
MD5 hash: 3d30141e56b312865d09680d0e461756
humanhash: sierra-colorado-romeo-social
File name:RFQ 18757 FOR CPUW-1022601_Pdf__.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:1'120'256 bytes
First seen:2022-09-30 10:27:45 UTC
Last seen:2022-09-30 13:22:36 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:LS6199Xe8b9ce0kxZf+IF22gMvoBoppQPYwZapxWui4bYzk6LfK1Gg0G4:n1Xu8SP8ZRlvoB+M7ZajWuwzXf8GFG
TLSH T12C35F1370BEA8B4BD021757884E1D2F6B399CD11E8B6C2977BCE6D1FF18A4219B50364
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook iso RFQ


Avatar
cocaman
Malicious email (T1566.001)
From: "Ibrahim BA Hashwan <sarstedt@teosat.pl>" (likely spoofed)
Received: "from teosat.pl (unknown [95.211.213.218]) "
Date: "26 Sep 2022 10:39:36 +0200"
Subject: "RFQ 18757 FOR CPUW-1022601"
Attachment: "RFQ 18757 FOR CPUW-1022601_Pdf__.iso"

Intelligence

File Origin
# of uploads :
2
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_pdf.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.389.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/6336c4b349c58ce767c43961/reports/183f77bf-efc1-4429-91af-947bf6252981/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf76a4636fbe2a304c8bd441e1e06118932ccb411f7323c6e5e2dde1a952eee2/
Threat name:
ByteCode-MSIL.Trojan.Tisifi
Create hunting rule
Status:
Malicious
First seen:
2022-09-26 03:21:15 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
18 of 40 (45.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x53kiy3pxyvdatel2ra6dydbdcjszs2bd5zshrxf4lo6dkks53ra._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:o6ho rat spyware stealer trojan
Link:
https://tria.ge/reports/220930-mhnh4aebdm/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bf76a4636fbe2a304c8bd441e1e06118932ccb411f7323c6e5e2dde1a952eee2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso bf76a4636fbe2a304c8bd441e1e06118932ccb411f7323c6e5e2dde1a952eee2

(this sample)

Formbook

Executable exe f281fed414237c484d936802d8bc112995ba6df5c9485207a284b8fc31edf2e6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f281fed414237c484d936802d8bc112995ba6df5c9485207a284b8fc31edf2e6
  
Dropping
Formbook

Comments