MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 150bca9ea5a4c5835f0e665b2db300d12a741b3a452c74678be7d0ee8236668f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 150bca9ea5a4c5835f0e665b2db300d12a741b3a452c74678be7d0ee8236668f
SHA3-384 hash: 47d369cbad98ad94fa65184d84f712b5f7c1909f48003a15c139c2169336b9f5fb20f1b175e3d118b95ac1adcd47f4a0
SHA1 hash: ec90b9cdaff4a1a275afca06c661147cb406631c
MD5 hash: d61ae62c42d047b697c3b61e683112cf
humanhash: august-cat-angel-avocado
File name:ENQUIRY PLEASE.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:492'544 bytes
First seen:2020-05-06 09:49:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:qkwONZcbNiKrY8padtyI3hAouqT8egaK4StyOgSYcJpCYXPJ1sB9:qkRNZErY8EzH3hRfT8Tat8Fs
Threatray 5'962 similar samples on MalwareBazaar
TLSH D3A4AD56BA71EEBFCAF2B4BB44543C145E1C6DA54EA67142706BB198FDBF803CA100D2
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: colorntouch.co
Sending IP: 111.90.141.162
From: Purchasing <purchasing@majuuniversal.com>
Reply-To: intertradeemito@gmail.com
Subject: REQUEST FOR QUOTATION - PR-S/P-100789
Attachment: ENQUIRY PLEASE.rar (contains "ENQUIRY PLEASE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisD61AE62C42D0.28360.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 03:59:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
50
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cuf4vhvfutcygxyomzns3mya2evhigz2iuwhiz4l47io5arwm2hq._file
Verdict:
malicious
Similar samples:
0a569518c639a3016fb301034043c0f1536cecd205196f0c1321c77ea0e941e2
FormBook
19e839e299b4a6f1ddbfb8f1adae91011b0cd40d9d095b5de75004becd7a364c
FormBook
223bbe1af0d09289a1ebeddf78e3218fcae28d0a69c291d66fee5fa29337844a
FormBook
3fbaa0ca4cd86fb032909b6ba6530930b0ad14aa4fd39b5059380f51c31c3808
FormBook
568a6bfbf5ce68d84fba719dcbee920751fb52b24890c6a9f6258aa670026d07
FormBook
5b6b8e78568b828610d9d85128e14e34938614f7fc2885569995834678da14b2
FormBook
76333652b5c82499dde362e8892ff2316a455ee5118f6127d6462ec3654cd544
FormBook
8842ac3497c777517b2f18152eabaa0994a460d249773a5e89a4e16bca2bd741
FormBook
c97caa35170c05c95c5b92a03068cfa944ad0d629fdd23d1fd11f7af4d5da095
FormBook
e64a40c05ac395f8751ac149772087476c75ae46a7e7831fbd00b20fd3edcf99
FormBook
+ 5'952 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan persistence
Link:
https://tria.ge/reports/201109-amr26jtqae/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Gathers network information
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Deletes itself
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.howndey.com/xd4/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar fc60f35036615326fe349934764aebaeb7d0bdc39dde5603a57cc7ee08f66171

FormBook

Executable exe 150bca9ea5a4c5835f0e665b2db300d12a741b3a452c74678be7d0ee8236668f

(this sample)

  
Dropped by
MD5 79f181591ca264363711dacff08f30e1
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 fc60f35036615326fe349934764aebaeb7d0bdc39dde5603a57cc7ee08f66171

Comments