MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ad79d7dfc755f667699bcc18f5bc0c3a64f09d1a969f7ccff0f255505cfc20c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	4ad79d7dfc755f667699bcc18f5bc0c3a64f09d1a969f7ccff0f255505cfc20c
SHA3-384 hash:	a52cf8bfbc9c4beb48f0ecaa69f039614add2eca0feda69fd0941af0c3abee22f083df8e9f3b1d7b787590b42aeb3318
SHA1 hash:	43052e6724430be436c051c30626beee841bef36
MD5 hash:	a247f73a6b65b56a6eea6f18955b1bd2
humanhash:	sodium-finch-skylark-mars
File name:	PO'S_2020.exe
Download:	download sample
Signature	FormBook Create hunting rule
File size:	302'592 bytes
First seen:	2020-05-25 08:38:14 UTC
Last seen:	2020-05-25 10:16:56 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	6144:nxWyluM1puIWBlCpNIw2ZKX+6TR1Fx+O4/xWlXOIK+mtiiJAl:nx4MHhWBlC+c1D+OSxWRhmtiWQ
Threatray	5'113 similar samples on MalwareBazaar
TLSH	1D54F14033F827BEC97F67F9148629021BB3755A3216E34DCEC561DE5A66F804A40FAB
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing FormBook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: William Noah <w.noah@qualitech-solutions.cam>
Subject: AW: OFFICIAL ORDER ACKNOWLEDGEMENT
Attachment: POS_2020.rar (contains "PO'S_2020.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Siggen9.49554.17740.15893.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-25 10:39:59 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

2/5

Verdict:

malicious

FormBook

17b9dd3669aff525587ad15ad1a5232c766e18791cf4c3fe49cb783f7e75ea2f

FormBook

3a6e59f4903d46cc841f88279a674c8febc87d3e5d69c0b58da1864d1ea1d91c

FormBook

465aa7665bc5764af3c93c4413e745250c6ecbda447428a6f7630e2d5875f0f9

FormBook

48ce0e9cc96cb8d9ebe92bd7c1982e84d48baffdbada44d5949370a58ebae901

FormBook

5d11c69e8f7367536155879e0bbf5000892be66d64152804054043b922374509

FormBook

a4906242ed8ef857d5fe0dd5b8e3f1f90baa1bdf6f1030ba09af4a2b8892e08b

FormBook

a78ec6d8e8c174ed171a06e504d82e51c581858a66c28529de6f6700611ff024

FormBook

aa7cc20a00c3eeaeeaf4ddf79ea3dd717320050777ce67afe196afc443c0ac60

FormBook

b8fb24fed506f2b66406af4f29a8a0522564d337d9f374c3936b369e10a69437

FormBook

+ 5'103 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook coreentity rat rezer0 spyware stealer trojan persistence

Link:

https://tria.ge/reports/201109-sqymv922a6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Drops file in Program Files directory

Suspicious use of SetThreadContext

Uses the VBS compiler for execution

Reads user/profile data of web browsers

Adds policy Run key to start application

Formbook Payload

rezer0

CoreEntity .NET Packer

Formbook

Malware Config

C2 Extraction:

http://www.regulars6.com/i032/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.