MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dcc0b25c073c73ae67b48662ec4c81932ff862afdaac7cba1efa63290d6902f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0dcc0b25c073c73ae67b48662ec4c81932ff862afdaac7cba1efa63290d6902f
SHA3-384 hash: ed0813afa9a89ccc23cda023375d187e0f894727077c15f7794f6dd3a98b9f2933143a9621cb48d66fdc3ed3b895588e
SHA1 hash: fcbcb2007364db52e8ffa4327d26293c885c45d0
MD5 hash: 8cedb9db8e9bcb5d32def1faf7d83bb5
humanhash: october-mexico-edward-cat
File name:Payment Notification.pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:324'096 bytes
First seen:2020-05-22 14:11:00 UTC
Last seen:2020-05-22 20:34:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 255099a339a7f0c44ae1d5330f7354e4 (1 x Formbook)
ssdeep 3072:Ee56tbEjHbAxJzAW6EXXYicn6nvRytljFbJEKQpWzKkwYj/boKuUNZz78qvXCoze:E/tbjnzAW/oijnvR8FNxbeMpXDzdks
Threatray 5'119 similar samples on MalwareBazaar
TLSH 2F64BE22B568963CD93FA0B47AC7DEE6DDC594E3603F5C5AC42CC109C92CA82C597277
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: srv.polarbearcreative.com
Sending IP: 77.235.58.77
From: <noreply@fnb.co.za>
Subject: Payment Notification
Attachment: Payment Notification.pdf.zip (contains "Payment Notification.pdf.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 14:39:35 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
16e85e5268ed68c1741fd6293948d18a7ac9a2854e0938a015f8a894469f88b6
Formbook
38cafe26c2a04715f175182f36462f482bdbbcb1d875654b9ac1242c29f50b06
Formbook
5ad78a69716725c819bc307eb9627bea7479db03cbdc17d5930aa72341fabe73
Formbook
62629c366ee55b4376c03a63e8f94e121a3ff7cbecfcf22d0158515446a9457e
Formbook
6e67f9295d091f8c9fc762c738712a3516c295b3e22bc8f41465c8633cda5114
Formbook
76d45ff13654988781428940dab2825a158e15679d0f1faf9615b76a2cbff4a7
Formbook
9d545cae8b73e11800aaf794b2919bb8972511e4e217eaf1a51c3f38c17bb412
Formbook
b9862798fc67e4230e1339ab641fbedb31c66fb3cb3eceb27207531246a1a875
Formbook
ce860f3976ba5df3c4465a4b60d12980677dccc961a9fa91555c7b9de14c3dd8
Formbook
fc714509dc4c3d6f3e13028be7be8207b2377331266c8ce213c575e511f8d31f
Formbook
+ 5'109 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-yg1896r6cj/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Deletes itself
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.regulars5.com/ms20/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip df52c1042c3bf7ca6f13e76b04ab8f82f8aa70ac9fd131545794fa5631e08a3a

Formbook

Executable exe 0dcc0b25c073c73ae67b48662ec4c81932ff862afdaac7cba1efa63290d6902f

(this sample)

  
Dropped by
MD5 3b6f119ea9ce245786f44201e62cc7e9
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 df52c1042c3bf7ca6f13e76b04ab8f82f8aa70ac9fd131545794fa5631e08a3a

Comments