MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f77ffc2cd499f6b74149242e2a0e5694a9f684afbd1e335f9d3545e6c3a40651. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	f77ffc2cd499f6b74149242e2a0e5694a9f684afbd1e335f9d3545e6c3a40651
SHA3-384 hash:	a5acfa0392145cfbae785bfd9465c7cd205a0f95a268f1b0b2eea2fdf5940cd149efdd5ce038f824ba775d7d2da1f9ce
SHA1 hash:	6160a57b6d276e5277415dae6f657078d7f6065f
MD5 hash:	46de6e3ccac76d6d9c4c3e4919b7e135
humanhash:	glucose-two-robin-eight
File name:	Outstanding SOA.iso
Download:	download sample
Signature	Formbook Create hunting rule
File size:	409'600 bytes
First seen:	2022-12-16 12:54:57 UTC
Last seen:	2022-12-16 13:01:05 UTC
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	6144:Qkw5Ozbc0itHVpknYIuGGzQe+rnqLG529GmuVyvp0csCAFSu:WoyBMnYYHHb29BuVyvqh
TLSH	T1BE94230A11C610EBD4A4493048FB87F9FBB7820815BE969B7F9C5FA95F379D04D0A346
TrID	99.4% (.NULL) null bytes (2048000/1) 0.2% (.ISO) ISO 9660 CD image (5100/59/2) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter	cocaman
Tags:	FormBook iso

cocaman

Malicious email (T1566.001)
From: "Surplus Solicitors <amanda@greenboxdc.com>" (likely spoofed)
Received: "from adze.greenboxdc.com (adze.greenboxdc.com [88.209.254.164]) "
Date: "8 Dec 2022 12:31:06 +0100"
Subject: "Long Overdue Statement"
Attachment: "Outstanding SOA.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

119

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Outstanding SOA.exe
File size:	347'220 bytes
SHA256 hash:	2c57f3f9227d165321ad3ec29060b58358f3e95968cc1b4b6eff7eb978a993d1
MD5 hash:	301addb86ca3c942e69305684bf5c91f
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Rogue.0hr.20221208-1034.UNOFFICIAL

Gathering data

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f77ffc2cd499f6b74149242e2a0e5694a9f684afbd1e335f9d3545e6c3a40651/

Threat name:

Win32.Trojan.FormBook

Status:

Malicious

First seen:

2022-12-08 10:10:57 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 25 (64.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6577ylguth3loqkjeqxcudswssu7nbfpxupdgx45gvc6nq5eaziq._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:scse persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/221216-rvqlfaeh42/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f77ffc2cd499f6b74149242e2a0e5694a9f684afbd1e335f9d3545e6c3a40651

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research