MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7f1248ab83273f12ffeb413e1fe4d270f67047772362dfad1611554c3b360d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7f1248ab83273f12ffeb413e1fe4d270f67047772362dfad1611554c3b360d9
SHA3-384 hash: e97c90fa68d085c4c2b8c3e05925da0b20391a2a239e50198894462c698b838010f0fd02d38039b4f15fb9aa2234e1f3
SHA1 hash: f2b2db99ae248d8326aa727ed228f6234abdb737
MD5 hash: 68b79fb811ad4308d3235eae7241f867
humanhash: nuts-alaska-mexico-east
File name:Payment Advice.pdf.tar
Download: download sample
Signature Formbook
Create hunting rule
File size:609'170 bytes
First seen:2022-06-06 12:14:27 UTC
Last seen:Never
File type: tar
MIME type:application/x-rar
ssdeep 12288:dAwlO+KSjVBCY7yCUtVPZbHfUpnOfsXTxVUw9gVoR5BiWdm2mlE:ZU2uuUtVFHfUJWsXTwgvPCE
TLSH T1D5D42379D289EDF0BAA69AD92D30AECEF0D319356A73644BD1800149B15332A7D33F31
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook HSBC payment tar


Avatar
cocaman
Malicious email (T1566.001)
From: "HSBC Advising Service <advising.service@mail.hsbcnet.hsbc.com>" (likely spoofed)
Received: "from mail.hsbcnet.hsbc.com (unknown [104.167.223.52]) "
Date: "6 Jun 2022 17:29:02 +0800"
Subject: "Payment Advice - Advice Ref:[A1P1BDGzdufu] / Priority payment / Customer Ref:[USD10003482VP]"
Attachment: "Payment Advice.pdf.tar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f7f1248ab83273f12ffeb413e1fe4d270f67047772362dfad1611554c3b360d9/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-06-05 23:56:33 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
19 of 41 (46.34%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=67ysjcvygjz7cl76wqj6d7sne4hwobdxoi3c36wrmekvjq5tmdmq._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader campaign:eatw loader persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220606-pewreacdan/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Deletes itself
Reads user/profile data of web browsers
Adds policy Run key to start application
Xloader Payload
Formbook
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/f7f1248ab83273f12ffeb413e1fe4d270f67047772362dfad1611554c3b360d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

tar f7f1248ab83273f12ffeb413e1fe4d270f67047772362dfad1611554c3b360d9

(this sample)

Formbook

Executable exe 323d8b114ef8a92b6f5a31a08c97602166e534bda45338ce094a796cf7ac59da

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 323d8b114ef8a92b6f5a31a08c97602166e534bda45338ce094a796cf7ac59da
  
Dropping
MD5 0ffb5fe3637b1ed5f1a53522ae116891

Comments