MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 107d4394bfa5b162a8baddbdc46436edc68bfba40e2ab0183cf156889b151592. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 107d4394bfa5b162a8baddbdc46436edc68bfba40e2ab0183cf156889b151592
SHA3-384 hash: f55cfbc6ce8c80fe3b90908db6d4377e199b3b81b11e718c4585732ad41b7bc0bbc605067ffda07c8bd9881fabea3f2e
SHA1 hash: 173825c6f6b660d56f31295ea1100eee892a3d16
MD5 hash: d595c64a676227fd1847c75173976b55
humanhash: kitten-arkansas-north-bravo
File name:payment details_pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'559'040 bytes
First seen:2020-05-05 06:15:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:4tb20pkaCqT5TBWgNQ7arXHdctcpQHvwbc31206d8bErWK6A:BVg5tQ7arXHdctI+wo3I06zR5
Threatray 3'779 similar samples on MalwareBazaar
TLSH C875E01363DD8365C3725273BA69B741AEBF7C2506A1F86B2F98093DF820122525E773
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 02:17:00 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cb6uhff7uwywfkf23w64izbw5xdix65ebyvlagb46flirgyvcwja._file
Verdict:
malicious
Similar samples:
02b10c6690bd0ed3e9b675553519df78a7ede63a398d68304043eacb691fd305
FormBook
1edf8c6bcf0ae2b38e9e28bcb1fd838c2ea35b5b126e4bc9e42daa2e1e722298
FormBook
4f51da0a7034a3b491bf21d56896d2cc97f5f240911abfaeacfe73d80bd84a34
FormBook
76bf9fbbf199cdbb2c42d49a7d200e2c9b325fdc1c4ad2de205f40331a017243
FormBook
8ca9ad9aedc2d32e50609ca807c71c459560d63b78c9022d7b6d9ad480d19498
FormBook
9465c69c18144431c36b77e4b36534684c7717f1d9970eb522b8aef716dd2458
FormBook
a721e0a8a2daa0d5dee6ff75b846c1dbeb40f697221efb00866e450bea2b391c
FormBook
c9f7661a1a814820db663d5a916abd38a6c824429542e8b833c9a4e67974ac80
FormBook
d3664113994262962936ebe74d0355986970def0cd0bcdcf088fe102047df9ba
FormBook
db56fde2a4c2ad1841253b53a7dfde2da3a081c444cbc1180f4ac8068fcd9bb5
FormBook
+ 3'769 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan persistence
Link:
https://tria.ge/reports/201109-67smwbstvs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.ulxery.com/b89/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments