MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e17293b0ef3043d7848a7c453f86df5e654c459e03b0393187bba78d277b57f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e17293b0ef3043d7848a7c453f86df5e654c459e03b0393187bba78d277b57f5
SHA3-384 hash: a46c2d6772703a7fc9df7c32ea6a2e8192c44cdb46135a351624ed074c967532d3835d87a6b11cc26c7a7f7f48ee1dca
SHA1 hash: feaeb12a8d931faa7e38dae6d220d72a409c4051
MD5 hash: d22eb9a392a01e69b484f998699d6f54
humanhash: xray-avocado-floor-uranus
File name:Swift copy_9808.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:729'242 bytes
First seen:2021-06-01 05:22:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wl4SX3fJfsic0kJnErsruBgRq/HFfCYbPDy+kEqvBQEy2Qh2knlJooIWtEeWdEYL:yfJfQ0mnOsruBgRq/HlCsPOREqviEtQk
TLSH 35F42355EE257B6690360D2AA2BFE075F4A98DBB8F01061BFC3C9543811BC9987D313E
Reporter cocaman
Tags:INVOICE SWIFT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Account2 <rud-division@alkuhaimi.com>" (likely spoofed)
Received: "from alkuhaimi.com (unknown [185.222.57.72]) "
Date: "31 May 2021 17:23:16 -0700"
Subject: "Re: Invoice for Payment"
Attachment: "Swift copy_9808.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn112.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e17293b0ef3043d7848a7c453f86df5e654c459e03b0393187bba78d277b57f5
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e17293b0ef3043d7848a7c453f86df5e654c459e03b0393187bba78d277b57f5/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-31 23:47:54 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
11 of 44 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4fzjhmhpgbb5pbekprct7bw7lzsuyrm6aoydsmmhxoty2j33k72q._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210601-mxtnbffa5j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.xn--3bso4dxx8e.com/p6nu/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/e17293b0ef3043d7848a7c453f86df5e654c459e03b0393187bba78d277b57f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip e17293b0ef3043d7848a7c453f86df5e654c459e03b0393187bba78d277b57f5

(this sample)

Formbook

Executable exe 380d7d1bb1a62dd980d700d3f7d0dcb30ba83b21d93939eb86e64802f0e6f641

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 380d7d1bb1a62dd980d700d3f7d0dcb30ba83b21d93939eb86e64802f0e6f641

Comments