MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe91eaf1edcfee57a57e9cc45b61d539cc8f3088f111799ef711830a7400234e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 6

Intelligence 6 IOCs YARA 12 File information Comments

SHA256 hash:	fe91eaf1edcfee57a57e9cc45b61d539cc8f3088f111799ef711830a7400234e
SHA3-384 hash:	802ac06422bec42f0b79fb80f5dedf9df68d79efbd068d4d24d44cc417cf11e788ffa54cd5fdc263f198e11e75c93776
SHA1 hash:	21b99a67745df1ecd69f0ed449de7fb5d90e0da7
MD5 hash:	73ce3fed7a3c6cd9c0972d59ba86f934
humanhash:	violet-golf-yankee-lamp
File name:	ЦИТАТА.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	659'562 bytes
First seen:	2024-11-21 09:40:50 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:+UARXcLplaezfAglgEQNnTQEbu+SlK2tXVzjZxLlgYFyTbXRwP78lDnqHfHM:okptzfAMRQNnXSE2tVBxozOYlDnqPM
TLSH	T168E423E52F9281DB565EF9AA01C7347334424B355E765AFFB3DAA18F4F22C8900A811F
Magika	zip
Reporter	cocaman
Tags:	FormBook zip

cocaman

Malicious email (T1566.001)
From: "Sales Dep <info@vbk.kz>" (likely spoofed)
Received: "from pkz56-1-spamexpert3.hoster.kz (pkz56-1-spamexpert3.hoster.kz [185.111.104.60]) "
Date: "Tue, 19 Nov 2024 19:42:17 -0800"
Subject: "=?UTF-8?Q?RE=3A_=D0=97=D0=90=D0=9F=D0=A0=D0=9E=D0=A1_=D0=9D?=
=?UTF-8?Q?=D0=90_=D0=A0=D0=90=D0=A1=D0=A6=D0=95=D0=9D=D0=9A=D0=A3?="
Attachment: "ЦИТАТА.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

364

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	ЦИТАТА.exe
File size:	692'736 bytes
SHA256 hash:	2efd54686c3942f7778ae4ad63c002e50d1fd2a08fac36ac770dff40cb3e3788
MD5 hash:	57d485ab07368d3d7fbd1b62b8bb6a5f
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Porcupine.MSIL.GenKryptik.GUCY.292266.UNOFFICIAL

Porcupine.MSIL.GenKryptik.GUCY.292265.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=673d58a6cfd863d78e898815

Tags:

virus micro msil

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/fe91eaf1edcfee57a57e9cc45b61d539cc8f3088f111799ef711830a7400234e/results/dashboard

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fe91eaf1edcfee57a57e9cc45b61d539cc8f3088f111799ef711830a7400234e

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/241121-pf3akswphm/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)