MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56b9fd1bd9c1f7466020c1c2fed5d4bbbf1394c711921e91d8dc74fd7c6862a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56b9fd1bd9c1f7466020c1c2fed5d4bbbf1394c711921e91d8dc74fd7c6862a1
SHA3-384 hash: c943cf5fce2b87bd277ea77bc406492e8fb9ea47a855a7a0a5ffa961799340e6a19de87471dbd5053d8295ed3ec864b6
SHA1 hash: a8ba983d0183b723a20c0de9081ad3b011408b60
MD5 hash: aa5be116b97845c81a04395217c6e179
humanhash: nuts-april-whiskey-harry
File name:RFQ.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:352'768 bytes
First seen:2020-06-23 07:22:39 UTC
Last seen:2020-06-23 07:59:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:Se12z+/nqv7U5q5pMneaxDAo3fKCitioiR9i1LTgUAe1HO7n2mr:X1t/nqzp4xUX5S81Xkoxm
Threatray 5'257 similar samples on MalwareBazaar
TLSH C074AE7451EE12B2F32B8A31367CBD5047B1B1C7E7C1EA5C07ADE1A20BEAB516F4054A
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: ngay23
Sending IP: 45.127.62.25
From: Denko Trading Co.Ltd <madie@jenifereddleman.ga>
Subject: REQUEST FOR QUOTATION. MYANMAR DENKO TRADING CO., LTED
Attachment: REQUEST FOR QUOTATION. MYANMAR DENKO TRADING CO., LTED.IMG (contains "RFQ.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12903/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.fc.4051.UNOFFICIAL
Create hunting rule

Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/56b9fd1bd9c1f7466020c1c2fed5d4bbbf1394c711921e91d8dc74fd7c6862a1/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 07:24:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k2472g6zyh3umybayhbp5vouxo7rhfghcgjb5eoy3r2p27dimkqq._file
Verdict:
malicious
Similar samples:
116078d29890c8b0d748b2f2709d2768f7ad9ac04688db1f44189f019f62050f
FormBook
7aaba6dcdbb2649a4beeb5e877f26e4ff90aa1c59cb289620dc0098ec88cc663
FormBook
7f7f93ae7c3ce6bd7d154c2e2188bd39c7d511df8fc890e46085afc34acdba2b
FormBook
8347dcd8992d73ce59c612f2c59381d084fb88fbf2d30f167e95c8ddd4818dad
FormBook
89c61ae874590337a9538aeae605e8350af374e4c442a46f487f44b11d532915
FormBook
a58e85fa61d98c70d0f6bf421b73cf73709f36e77578fd52fc05cc85b4dd5419
FormBook
d338523f3836e958ad511ae3cca005a255a43bcc684174bf5928246fd477f2cc
FormBook
df8b72fbc5b86764cdbd998a0cbdbe404f3253f1a51029d5b46a778feb4839a1
FormBook
dfa8fa537be02efde6add76862693fb2f099e3339798cc1d05a2feff5409ab86
FormBook
f68b09a8adc07e084eda2fa581e9111716bb34bcba0565da70bda46860ce7c64
FormBook
+ 5'247 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/200624-njlcwjzch2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

bd726d73fb377c546a1859d6a506f4c9

FormBook

Executable exe 56b9fd1bd9c1f7466020c1c2fed5d4bbbf1394c711921e91d8dc74fd7c6862a1

(this sample)

  
Dropped by
MD5 bd726d73fb377c546a1859d6a506f4c9
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12903/

Comments