MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee59074846d3ecf2c33db03c039f8d2adfe6bd40fdfcd49f792bb92ac7887694. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	ee59074846d3ecf2c33db03c039f8d2adfe6bd40fdfcd49f792bb92ac7887694
SHA3-384 hash:	397e208001166605f97ceaef3514ab2f8c3ccc1f1f43df76523613c3d8add0d7e1c0ba9fdfaa239e998ed834ca6b14ce
SHA1 hash:	acbd1321e6eba9406873f73d7a51405490c29a22
MD5 hash:	ac9e06ce750ecdd584fa68c2e9f82c04
humanhash:	kitten-floor-missouri-juliet
File name:	Proof of Letter.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	185'212 bytes
First seen:	2022-11-11 10:13:09 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	3072:gPdd99HfoUO5VDNGr8fMdBFI6aTzhIOQx+NopH7Wdo3mYczrsPlQTBT8f9MvC7Cr:gHwUODDNj2BFWqOdebP96sNQTGFMvJe6
TLSH	T17604126B0358A000E5CF851E9C445197F0EDDE99FD1C1A2EC9ADB663E1C999C3217EAC
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	FormBook zip

cocaman

Malicious email (T1566.001)
From: "Business Department <office@architectural-glazing-parts.co.ukk>" (likely spoofed)
Received: "from [103.171.1.75] (unknown [103.171.1.75]) "
Date: "10 Nov 2022 16:38:10 -0800"
Subject: "Confirm is this get to you and reply the order !!!!"
Attachment: "Proof of Letter.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

n/a

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	login_info.txt
File size:	2'196 bytes
SHA256 hash:	027bcf5e169e9bf52aafd506126edc8f96c069b0ed8999c70079ac3a2bf3af5e
MD5 hash:	53220de40eef79068a14fb9541727e8c
MIME type:	text/plain
Signature	Formbook

File name:	bin.exe
File size:	188'928 bytes
SHA256 hash:	2a1c7f1e5b22d27648fff19b1df4e60614ff8dca1d080cab1d3009b73e051355
MD5 hash:	f86d4dffe9bb4c536070ea4df2028ae3
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL

Verdict:

No Threat

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/636e206a82dd9f2e26538995/reports/134c593b-fde1-4696-b377-0e5c53050d12/overview

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/ee59074846d3ecf2c33db03c039f8d2adfe6bd40fdfcd49f792bb92ac7887694

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee59074846d3ecf2c33db03c039f8d2adfe6bd40fdfcd49f792bb92ac7887694/

Threat name:

Win32.Trojan.FormBook

Status:

Malicious

First seen:

2022-11-11 00:14:48 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5zmqoscg2pwpfqz5wa6ahh4nflp6npka7x6njh3zfo4svr4io2ka._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:drg3 rat spyware stealer trojan

Link:

https://tria.ge/reports/221111-mdpwcsee44/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ee59074846d3ecf2c33db03c039f8d2adfe6bd40fdfcd49f792bb92ac7887694

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.