MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa6d6486dd772cf6b24da0d18052c469108d19af32d626f445e2029c5cbe7477. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa6d6486dd772cf6b24da0d18052c469108d19af32d626f445e2029c5cbe7477
SHA3-384 hash: 5386c7a6df4645e6aae753a742f123c9f04d880e46206c39a67708b1a533db0088944f5290329f5e1332f751173b9115
SHA1 hash: 4920723542a125d75d260c4f71984cd89d191654
MD5 hash: 24bb9288e1e6a51da65773b134e1ded6
humanhash: angel-washington-butter-table
File name:Purchase Order_xlsx.xz
Download: download sample
Signature Formbook
Create hunting rule
File size:232'679 bytes
First seen:2022-03-31 16:50:02 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 3072:WHel5mR4XXU+C1BoqsR9wBFYRLxqhDLZRti1iRlwh1euXEVqTdfSdjxaFo7iQr:95m6nhZRLxi1Rti11YuXBpSdNBr
TLSH T18434230824CE160B6D32D0A4AD693A84039F9B9999F415F46627BBF511345FF08DFF2B
Reporter cocaman
Tags:FormBook xz


Avatar
cocaman
Malicious email (T1566.001)
From: "Tom Hight <admin@2080technologiesllc.partners>" (likely spoofed)
Received: "from ns-882.awsdns-46.net (unknown [45.58.41.24]) "
Date: "31 Mar 2022 09:44:22 -0700"
Subject: "FW: MLCO Purchase Order - Inquiry (282104445)"
Attachment: "Purchase Order_xlsx.xz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
315
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25065.RarHeur.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6245dbf91f204239485da3b8/reports/c26bd2da-efb5-43d9-97d5-45310ac27976/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa6d6486dd772cf6b24da0d18052c469108d19af32d626f445e2029c5cbe7477/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2022-03-31 16:51:04 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
15 of 42 (35.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7jwwjbw5o4wpnmsnudiyauweneii2gnpgllcn5cf4ibjyxf6or3q._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:by73 rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220331-vcs6dsbagl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa6d6486dd772cf6b24da0d18052c469108d19af32d626f445e2029c5cbe7477

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

xz fa6d6486dd772cf6b24da0d18052c469108d19af32d626f445e2029c5cbe7477

(this sample)

Formbook

Executable exe 45a19ea1dcf965e6baa12c63ab7be3bf7c550a7573f40a7af04698d56af7a706

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 45a19ea1dcf965e6baa12c63ab7be3bf7c550a7573f40a7af04698d56af7a706
  
Dropping
Formbook

Comments