MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb77f1cd086efbc878856390a2d505c3216c52a85b662f83f333b23b3a728644. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb77f1cd086efbc878856390a2d505c3216c52a85b662f83f333b23b3a728644
SHA3-384 hash: 33617c57a80841aa9e313b159290d96921b0d62e54bd4253e5e41e7c618497414bfb2dbbc6a647e3a1981cd52b003a5f
SHA1 hash: 7f8a0db12c8928bb582e31ad54146438e35d90f5
MD5 hash: aa31d165aefa28035d67749defe80187
humanhash: uncle-salami-chicken-seventeen
File name:Payment Advice.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:487'077 bytes
First seen:2022-06-28 14:34:48 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:bkgxZVhdHrABqkXqUEPnCBn2R7OD4wEI3YRYeG2NN4o2BY82KvZXrtY7MKU:xxZ1LkXqd/CBE7OD403jw82K0vU
TLSH T166A42394347A0779D3A7E4B6053A7104842E90D4AED69B74FFA0D78F4DE3A7326A083D
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook gz payment


Avatar
cocaman
Malicious email (T1566.001)
From: "Konig SA < infos@alzayatpkg.net>" (likely spoofed)
Received: "from alzayatpkg.net (unknown [45.57.161.44]) "
Date: "28 Jun 2022 06:58:18 -0700"
Subject: "Payment Advice - 0776492833"
Attachment: "Payment Advice.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb77f1cd086efbc878856390a2d505c3216c52a85b662f83f333b23b3a728644/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-06-28 13:46:10 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
19 of 39 (48.72%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7n37dtiin354q6efmoikfvifymqwyuvilntc7a7tgozdwotsqzca._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ir93 rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220628-rx2rgsbgd7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/fb77f1cd086efbc878856390a2d505c3216c52a85b662f83f333b23b3a728644

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz fb77f1cd086efbc878856390a2d505c3216c52a85b662f83f333b23b3a728644

(this sample)

Formbook

Executable exe abb347ac140c2ba551fe45121675aa273b9ea265337baa3e54aa4b93d2fb6db6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 abb347ac140c2ba551fe45121675aa273b9ea265337baa3e54aa4b93d2fb6db6
  
Dropping
Formbook
  
Dropping
MD5 ab0deff2c852d449951896bc746c6229

Comments