MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656
SHA3-384 hash: e98c1819408f7d3ca1b4199e1847253cefb3f1b6e1d284bd68115efa8361c4f713507f4cb21b92b07da5c0346d03bae6
SHA1 hash: f0ec88d85309c0dcba9e0b1eafc2c4634faf65ca
MD5 hash: bbc309067d5933ca124b0c4bf03a9d18
humanhash: uniform-sweet-burger-enemy
File name:Payment Slip rar.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:759'185 bytes
First seen:2025-01-20 14:04:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:JDHiUSy1M4WJQyk8QYDGCoqIhekCcHOD15xD2Kv2AwT4h6IVDgEzultOuo6piqWF:pgyAyPAGxqIhPCoO5ZhA4h6I9grzOuo1
TLSH T111F433B4F251B3F6DFD270D03BEEE04F1F797A1164A8B604518BC680D2397A6B156272
Magika zip
Reporter cocaman
Tags:FormBook payment zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Stefan Wawrauschek < info@easternvertex.com>" (likely spoofed)
Received: "from [103.237.86.247] (unknown [103.237.86.247]) "
Date: "20 Jan 2025 15:15:28 +0700"
Subject: "RE:BANK DETAILS CONFIRMATION FOR PAYMENT"
Attachment: "Payment Slip rar.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Payment Slip rar.exe
File size:795'648 bytes
SHA256 hash: 7f10867f8a37f96369cf305b122fa7f5fb3f61e0a98dc35d66a7206530557c1d
MD5 hash: 4513ccf66f6171fdb90d2027bb2656eb
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs3369.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.PWSX-gen.16753.25498.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678e2e08e708b6e7a3ad9183
Tags:
malware
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/678e58132a063b4c6e8987be/reports/cf43603e-c39d-44e6-9647-00eb9c35aa9f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656/
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2025-01-20 06:44:46 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ietgtl6tsfcfaudi3ry4lbf6qh63eepmnladvkpixcqacfiazla._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250120-r9we8svlhp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip da09334d7e9c8a22828346e38e2c25f40fed908f635601d54f45c50008a80656

(this sample)

Formbook

Executable exe 7f10867f8a37f96369cf305b122fa7f5fb3f61e0a98dc35d66a7206530557c1d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f10867f8a37f96369cf305b122fa7f5fb3f61e0a98dc35d66a7206530557c1d
  
Dropping
Formbook

Comments