MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68b0e57c728398876c4a835e93ff8e5fe6e90d05175a8815ac17b8a4ba4c68cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68b0e57c728398876c4a835e93ff8e5fe6e90d05175a8815ac17b8a4ba4c68cc
SHA3-384 hash: 792dc7502426a3f7c075420c80c8e17e4b4908642a2458a10685e3fd2325ad21c9d14f443715c8157f39d5c16c2502d6
SHA1 hash: 7b139c6f89411f8f00c08a3f0a71d84beb7da6d9
MD5 hash: 0914362e110fc66365b2574bf609ccb9
humanhash: pip-fish-sweet-william
File name:swift copy_pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'230'336 bytes
First seen:2020-06-10 07:43:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:GAHnh+eWsN3skA4RV1Hom2KXMmHacRg0hikwWOtAvA5685:hh+ZkldoPK8YaczFwWOtmA5d
Threatray 4'936 similar samples on MalwareBazaar
TLSH 6B45BE0273D1C036FFABA2739B6AF60156BC79654133852F13981DB9BD701B2263E663
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: gains.creationmediaindia.com
Sending IP: 184.171.174.122
From: SEOJIN SHIPPING CO., LTD. <info@bluebirdshipping.in>
Reply-To: sjship@siship.co.kr
Subject: RE: Remittance Advice
Attachment: swift copy_pdf.arj (contains "swift copy_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 02:04:48 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncyok7dsqomio3ckqnpjh74ol7tosdifc5niqfnmc64kjosmndga._file
Verdict:
malicious
Similar samples:
0b754578fd025440dc9661b2a4f0c853fa57a9dbb2c33d27ff7802176d38238b
FormBook
0f8acbcde0c3f0f60b101a72f778b7d29a9a799f607e4ec00aa28dc734d0fbfa
FormBook
3bc2e6f78c3a261a13546f719d6b089dab1730e8f6539d7ab7a319fc3e410270
FormBook
3f86f49f3c2e3583c70385971bdba545c85d8f2d66f8923bf446dde88be3afc0
FormBook
82a761b4157d1fa4e99dbf36c0f30935b19a1dd9875e330d81a70877aa07bc8a
FormBook
b64442a995a9b13bc92c58cb492ba2ca7a5c8d3a21ac26c6cda19faa42796ceb
FormBook
d34f87c6a070f4f73344156c16be7040f2932053aea2868e98b0fa4297113835
FormBook
e273d82c782a01c388cc619e6832bfb43301f4308884751b9393262302fc84c0
FormBook
e99c6ae5a08e119d151f0c28b6b164d98ca6fd24d1d91b6f57bdf40f3d688c91
FormBook
f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510
FormBook
+ 4'926 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-9d76bfwk4x/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.govaj.com/w1g/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 237b20da59e939233637255b56164dbb10150ae8fc6ebb0c2bfb20545027b16b

FormBook

Executable exe 68b0e57c728398876c4a835e93ff8e5fe6e90d05175a8815ac17b8a4ba4c68cc

(this sample)

  
Dropped by
MD5 af57aa13224526e9d1425dcd56ea1a8d
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 237b20da59e939233637255b56164dbb10150ae8fc6ebb0c2bfb20545027b16b

Comments