MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f256c15a96f8f556978318a55308e3ef709f29d93a18d0c2d262f305477cfb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f256c15a96f8f556978318a55308e3ef709f29d93a18d0c2d262f305477cfb2
SHA3-384 hash: 9c239983dddac503d170c6682e6decd4b6bd23ada8f7cd58c303db43a4b6edf7955a56ea2c0360b4b173267b801adb61
SHA1 hash: 411ef3c0904c481a921760f6554889aa2907bffd
MD5 hash: c63bd0a773e8db6b24cac95d9ea6ccfb
humanhash: magazine-magazine-carpet-florida
File name:MV AIGAION RFQ-doc.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:619'008 bytes
First seen:2020-05-06 04:57:26 UTC
Last seen:2020-05-06 05:37:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ff5d38f8ce7becc9e2b75dea8647115f (7 x AgentTesla, 2 x Loki, 1 x FormBook)
ssdeep 12288:CUXBVVN+jL7n5fsr+7YHQp6JCkvOgUGcIIHIn8rRTUR3LXRphx7ncFjLABV:Ce3VNy75YzIPeOpZHYLRp8FjE
Threatray 4'546 similar samples on MalwareBazaar
TLSH 04D4C036F2D0443FD2732A3C9C5B56A8AC3ABE503E2958463BE81D4C5F3979239652D3
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-1
Create hunting rule

SecuriteInfo.com.Trojan.Nanocore.23.8655.16476.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Nanocore.23.31273.12919.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 05:27:01 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h4swyfnjn6hvk2lyggffkmeoh33qt4u5soqy2dbneyxtavdxz6za._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
040e2a7b73768aea00579bd04fa834afa4b33966459c4c9d4c4cddfb7cffe8c0
FormBook
1c7388bfdfb41e34dc95423b351d3b18d737889d9f8648da0ce24048d6e2f495
FormBook
1d24189fffd0bdcb0395a3670721f29f37d08bd80565471db28d45ac36b2cbc9
FormBook
1d26a5cf8e279ddaa3ad924224219b550f7d431e8d6adbcb7bd36c01d4eae2d9
FormBook
2fdb0d7b083751a10db872738e974f869b99f2ca21891a5fb96bc9440f827ffb
FormBook
490a783bc399cb6dd9b64ecc8d0f909830fe1a351d18f148493fcdf6eefb52cd
FormBook
5ef5d6bc0c7af14274c71cdc4377785a79143786556262137f496a94170ac56b
FormBook
811b6950ba9561169b22ccfc12daf0fc57f26a910272f56288bd0d7c10da5c15
FormBook
bca55e158b112f5d776f4402d48cdfaf5ae42b4d8f2e063ac69ba2405bfcc60a
FormBook
c303fb93eba5623184f5bfb8fefbea2458e25ead795e6d5c5d5e78e921c6490e
FormBook
+ 4'536 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan persistence
Link:
https://tria.ge/reports/201109-lsbevnzb1e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of UnmapMainImage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.nyoxibwer.com/hm2/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe 3f256c15a96f8f556978318a55308e3ef709f29d93a18d0c2d262f305477cfb2

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments