MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 154abcf7b4d3b8ff3395661ee7a03dc8e473f9dc3fb51386a1c49d881bc62387. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 154abcf7b4d3b8ff3395661ee7a03dc8e473f9dc3fb51386a1c49d881bc62387
SHA3-384 hash: 8fb4378438ba03fb408da08409bb1459accc7a9c42306af0b3e4f2b7e7230dd8d9e47a2cc602379ecf4b5f142746a2b2
SHA1 hash: 0046731e2d3a8f5065bdb4731f5cb77d2da2169f
MD5 hash: e7061d2ac21ce349e362d0fa80f24b0c
humanhash: don-juliet-pasta-arkansas
File name:e7061d2ac21ce349e362d0fa80f24b0c.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'230'336 bytes
First seen:2020-06-10 07:23:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:8AHnh+eWsN3skA4RV1Hom2KXMmHattAkWogUk/T38xLH5:bh+ZkldoPK8YatbriTKF
Threatray 5'429 similar samples on MalwareBazaar
TLSH 1D45BD0273D1C036FFAB92739B6AF64196BD7D254123852F13981DB9BC701B2263E663
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 04:19:07 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cvflz55u2o4p6m4vmypopib5zdshh6o4h62rhbvbysoyqg6geodq._file
Verdict:
malicious
Similar samples:
0a06767c6ec2249902ef118e04b2044b9784b544b81a7f5e253ae373fd706ceb
Formbook
0b6acf8d9861c0c69b88b7a7bf1427c5245bbd968e96db1cdb08b8432442c729
Formbook
112b6fe2084ca3501c8a98a9cd90f60ce691a438864be736b049062379195818
Formbook
1cc899a5fc4a3e7fe1c9d1265b60a4faf51bc1df3e4b25c088979755410fa954
Formbook
3f86f49f3c2e3583c70385971bdba545c85d8f2d66f8923bf446dde88be3afc0
Formbook
5b5dcd2dd420cb6a9ef69b94fb8340145ca859897285ef38d87b38b1757af463
Formbook
5f657de9b0eaeb9eabf6d18a202f7b8c7daafd71d03387366069fe9ebd5f282a
Formbook
6f827b68129d30609057c2e6b36be05649fce91d6bc8ee3d3566ca5c6aba562b
Formbook
9295ce88660ed117b7cfff0886232a51dc6492bf6100738957bf93fabdb74bb8
Formbook
e6de9e86b470184110650c77b487796a8fb27d67a60b9e0ca7a113df7eefdde6
Formbook
+ 5'419 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-ravasf81zj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of UnmapMainImage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.porcber.com/pp0/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 154abcf7b4d3b8ff3395661ee7a03dc8e473f9dc3fb51386a1c49d881bc62387

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/383158/
  
Delivery method
Distributed via web download

Comments