MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5bc8a4b4bdd0dc3e44464209633552f942177d93bc2d9a957d4e434c5e8b0f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	c5bc8a4b4bdd0dc3e44464209633552f942177d93bc2d9a957d4e434c5e8b0f9
SHA3-384 hash:	fe217231ae1aa1ee28663751fcbc6815ccd1c7d49bd467e196101e0ff5f048dbfa4649aecb3103cc62cf7b58402e20ab
SHA1 hash:	df36432bc55af3ef3271b7f7200406c51e7f28a1
MD5 hash:	3fa620586430b9dd99c04f2cd2a19ee3
humanhash:	timing-eight-montana-earth
File name:	Invoice.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	788'008 bytes
First seen:	2023-06-09 09:00:25 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:dk3XjiWtcUeVxeftyM07L0Wpg6bjm0lwBHMLPnZlgCcJvW8QoUwERCy4giaAfx4L:eXjosfPxWO10OybgtJ+nRCy4bxwBrpx
TLSH	T170F423C94C831E36C479E5D585DF7CFF4E3E21C1ADB02A225EEC6B50A92881831975FA
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	FormBook INVOICE payment rar

cocaman

Malicious email (T1566.001)
From: ""Anwar Marcus" <mahindranorthcoast@telkomsa.net>" (likely spoofed)
Received: "from telkomsa.net (unknown [185.222.57.84]) "
Date: "7 Jun 2023 00:12:04 +0200"
Subject: "RE: Confirm revised invoice to proceed with payment ASAP."
Attachment: "Invoice.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Invoice.exe
File size:	846'848 bytes
SHA256 hash:	395133081793df5c1542b9e77a64a5271d1b358c1a7db674108a7624a9104809
MD5 hash:	62f18cccad8ad9056639f5894b1fa5cd
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/c5bc8a4b4bdd0dc3e44464209633552f942177d93bc2d9a957d4e434c5e8b0f9/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

bladabindi formbook packed

Link:

https://www.filescan.io/uploads/6482ea4f15a07ef7440e7845/reports/93cf350b-e12e-4975-8f1b-4ee7b2351d25/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/c5bc8a4b4bdd0dc3e44464209633552f942177d93bc2d9a957d4e434c5e8b0f9

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c5bc8a4b4bdd0dc3e44464209633552f942177d93bc2d9a957d4e434c5e8b0f9/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-06-06 23:47:00 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 37 (51.35%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yw6ius2l3ug4hzcemqqjmm2vf6kcc56zhpbntkkx2tsdjrpiwd4q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230609-mz4xeacg2v/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c5bc8a4b4bdd0dc3e44464209633552f942177d93bc2d9a957d4e434c5e8b0f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.