MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 234bac494cfbfe7b41f3b4910dde4912b521e733fc30d0f83f34fca0f902ea29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 234bac494cfbfe7b41f3b4910dde4912b521e733fc30d0f83f34fca0f902ea29
SHA3-384 hash: 9e194727cad3df13d18bf20e623c8e22d17339a127c6ec2b0aa079f368c97f44c812b3255759c2bafa78c45fdc49fc67
SHA1 hash: 2245968ed7d92a8c35606b8a6a191253d1a7eca7
MD5 hash: 877e8ab4d4f6ee3a96df237f4a94f01a
humanhash: salami-carbon-one-kansas
File name:PO52961107.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:545'792 bytes
First seen:2020-05-04 18:23:23 UTC
Last seen:2020-05-04 18:55:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:e+NjprJlc0geFAdOeFA4pOFm4lDKX2zsf/FHsVovVEdV/3Caw:e8rJl1gzdOz4pOFDpPsf/FHsl3
Threatray 2'253 similar samples on MalwareBazaar
TLSH 8BC44A32E280C425E4964EB3983ACD93593B7F583525A71F22EF77181EB33563369A0D
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail3.alwayson.net.bd
Sending IP: 117.58.240.118
From: ATLAS INC <jalil.woven@fakirapparels.com>
Reply-To: postmaster.fakirapparels.com
Subject: New Order From Atlas Supply Inc
Attachment: PO52961107.iso (contains "PO52961107.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33776536.19697.29719.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 12:49:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=enf2yskm7p7hwqptwsiq3xsjck2sdzzt7qynb6b7gt6kb6ic5iuq._file
Verdict:
malicious
Similar samples:
223bbe1af0d09289a1ebeddf78e3218fcae28d0a69c291d66fee5fa29337844a
FormBook
52b517b0e9be1efed3349ff5b7e7e4a392881437d7bc9ccd7b94bbc23e28a2f9
FormBook
5628310c6fe718d77dadbc5c8cb6238faa27942517b590c2a87c07aadca429d6
FormBook
6b9cb325f344a3cf4dab6eb4c6b8f16a197febb7c50cc12de6a4a6c0e41792d1
FormBook
7fd869c92b40b50ad0dead4c92452b46d7aee7570b3ac1660af632bb26e316c4
FormBook
916237116e09e4233846389b7410a8ccc7e7ef96c0ed97c3fdb19a08499504af
FormBook
bf58aecacc268c49d707512236a42c80cf096b24850c3096eb056f662ecbe2e3
FormBook
c8d588cae4d2691221f0b518d6a663c498f28663b9cb806df73249ced7b71322
FormBook
f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c
FormBook
ffe5b585cebd48c48d45d315506f232f43b77761225cb349fe80e73bfb2485d5
FormBook
+ 2'243 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook agilenet rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-bg4hkwvvne/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Gathers network information
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Obfuscated with Agile.Net obfuscator
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.godhep.com/cl0/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso a1ac71d605202ad4cbf21be5a3a3a1195c2caa6df1f4010fc67a0f4cd83ccbc3

FormBook

Executable exe 234bac494cfbfe7b41f3b4910dde4912b521e733fc30d0f83f34fca0f902ea29

(this sample)

  
Dropped by
MD5 efa7e458363f1ffe516a4707ce466903
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 a1ac71d605202ad4cbf21be5a3a3a1195c2caa6df1f4010fc67a0f4cd83ccbc3

Comments