MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67586cd711a0de6176d2df1bde9bf36f024f893328ae9c447bdf5e636e99502b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67586cd711a0de6176d2df1bde9bf36f024f893328ae9c447bdf5e636e99502b
SHA3-384 hash: 5770ebfe6398cc8845e13f536d76d5761bba169ab688eab8e502208558b9834d69e57ec1bda30965e96661f4e636fdc1
SHA1 hash: 3c4f5196619e53c35c05cf8ace20cfbb2400cda1
MD5 hash: 045898722f8be5ddea3bbd6532878cbe
humanhash: mike-river-oven-beryllium
File name:R7566091253.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:836'096 bytes
First seen:2020-07-10 11:14:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6c5aa4620701f1d844f97acdde133aa4 (7 x AgentTesla, 1 x FormBook, 1 x 404Keylogger)
ssdeep 24576:/3j4a6OSlEbh3ndz9N2n7hoVQQz0BgL+:/3jeOvXx27hW0BF
Threatray 4'562 similar samples on MalwareBazaar
TLSH 6A05BF62F2E14437D1B3FA3E9C1B93A4983ABE512D38A9463BE51D8C4F3469139253D3
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: plesk4.hipernet.es
Sending IP: 87.76.28.36
From: info@almacenesmame.com
Subject: Demande de prix
Attachment: 5432222.zip (contains "R7566091253.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24368/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Launching cmd.exe command interpreter
Reading critical registry keys
DNS request
Setting browser functions hooks
Possible injection to a system process
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Deleting of the original file
Unauthorized injection to a browser process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/67586cd711a0de6176d2df1bde9bf36f024f893328ae9c447bdf5e636e99502b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 11:16:06 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m5mgzvyrudpgc5ws34n55g7tn4be7cjtfcxjyrd335pgg3uzkavq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0a6caea4ce7bf55029e1f01895a6c653fb2c5166f76dafcf94956dd8915e4eab
FormBook
163065b27e36ce19e815d862a46534b6b7a048be46562ae48c3811fb35fa3338
FormBook
16de0aa2d02fae6460bb173c9104df4fa758343ab226aea79a3910dce19fa58e
FormBook
347aa505ad319b4d8ee54aabe34dfc2af12b4747af23c6b635821ba9aedd0e32
FormBook
7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6
FormBook
8e5e93b6f3eee7f1a08a0420b25105017d3479769e6bf9d6b2518d3abc6b1a75
FormBook
9c0d3c463792d704909de3a04cd7a6d31f8094301e8e24950af31cdc5e9f2838
FormBook
9fba6ffeb90dd242748718d8272a4942496e76a4f68bdb4dd42f93b044b5ed50
FormBook
de55a1b3e711c74c00998d9c4cb0f5da9672b109e2f362ac55f4a9f4033ffbf7
FormBook
f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c
FormBook
+ 4'552 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
persistence spyware trojan stealer family:formbook
Link:
https://tria.ge/reports/200710-tpvq9vqf6x/
Behaviour
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System policy modification
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
System policy modification
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Drops file in Program Files directory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Deletes itself
Reads user/profile data of web browsers
Reads user/profile data of web browsers
Adds Run entry to policy start application
Adds Run entry to policy start application
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

e9dd111255d3b190aff2551686c76db5

FormBook

Executable exe 67586cd711a0de6176d2df1bde9bf36f024f893328ae9c447bdf5e636e99502b

(this sample)

  
Dropped by
MD5 e9dd111255d3b190aff2551686c76db5
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/24368/

Comments