MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e177b2bdb97a1afb16897c994ec46dc6ecdd1e686d7c8058cc7607411d4cdedb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e177b2bdb97a1afb16897c994ec46dc6ecdd1e686d7c8058cc7607411d4cdedb
SHA3-384 hash: 6af032d0e711f94ba1631d6d861fb3df2a05ef0bd9bd1088cbc888dc4b7e79147febc350d48707d35d1275bb9256551a
SHA1 hash: 50a63ed2509044d3a90f6e6be43e2c8cac248f76
MD5 hash: 006cd559b02c0f4ef0df7e2d44e52406
humanhash: robin-hawaii-missouri-oscar
File name:SOA.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:14'446 bytes
First seen:2022-04-19 11:49:06 UTC
Last seen:2022-04-19 20:54:09 UTC
File type: rar
MIME type:application/x-rar
ssdeep 384:yPoxt95nMcoKKxUG6IYT/VgobMFBmsreFLaAZF:zMcZKoIk9gdreFG+F
TLSH T13652CFD05CAF908E6BF13F49803E7971D23335D947BFA9B48666E3058AB18666F04325
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Abdulrahman AKC <accountant@grannitto.com>" (likely spoofed)
Received: "from [212.193.30.5] (unknown [212.193.30.5]) "
Date: "19 Apr 2022 11:30:07 +0200"
Subject: "SOA/Al Khaleej Ceramics Co"
Attachment: "SOA.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/625ea1ecffe27d51190b3dc8/reports/1832eeae-98dd-43a9-ac51-e3829cda95cd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e177b2bdb97a1afb16897c994ec46dc6ecdd1e686d7c8058cc7607411d4cdedb/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-04-19 11:45:25 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
18 of 41 (43.90%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4f33fpnzpinpwfujpsmu5rdny3wn2htinv6iawgmoyduchkm33nq._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:fk84 loader rat
Link:
https://tria.ge/reports/220419-nzkzzaadb7/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Xloader Payload
Xloader
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/e177b2bdb97a1afb16897c994ec46dc6ecdd1e686d7c8058cc7607411d4cdedb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar e177b2bdb97a1afb16897c994ec46dc6ecdd1e686d7c8058cc7607411d4cdedb

(this sample)

Formbook

Executable exe 188e88b01bc05b9e23ce3133471d99ecaec9515404faa787f745fc70bafe4656

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 188e88b01bc05b9e23ce3133471d99ecaec9515404faa787f745fc70bafe4656
  
Dropping
MD5 cfa809c8fb2550c63f63136893075d04

Comments