MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7302711920290930c1668ecf6519c207fdafb56b7f6d894b1e3fd4e4b920ad81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7302711920290930c1668ecf6519c207fdafb56b7f6d894b1e3fd4e4b920ad81
SHA3-384 hash: 8106911e1787ffcad3f4ec6e4ca52d42ab54e1d3889d1a9635cbd04986251bbc1e569569d7aee15d04017813d83cb568
SHA1 hash: 82dc7b210b1f5a36e56f173e01d68a736dfa3952
MD5 hash: 66ed577495ab6748e340ae6ca3e5d52f
humanhash: cold-hotel-helium-one
File name:P.O. 27000446.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:646'544 bytes
First seen:2020-05-04 20:34:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5ca45b17f4fc6e1f91fb2d09369768d3 (4 x FormBook)
ssdeep 12288:doU8HWAyC6Bq4g7Anm+UNoxGsHH0WOSdhWU2SEwrK4/9EGdx5FPITLK3D3VImufZ:a/HWAy044T+UNrZiEuTPMW3VJufWc
Threatray 5'076 similar samples on MalwareBazaar
TLSH 7CD402457268540EC4BA6B7146FA4B3992B3EDD645E034ABBED3B08C8C38B145177F3A
Reporter abuse_ch
Tags:exe FormBook

Code Signing Certificate

Organisation:VeriSign Time Stamping Services Signer - G2
Issuer:VeriSign Time Stamping Services CA
Algorithm:sha1WithRSAEncryption
Valid from:Jun 15 00:00:00 2007 GMT
Valid to:Jun 14 23:59:59 2012 GMT
Serial number: 3825D7FAF861AF9EF490E726B5D65AD5
Intelligence: 44 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 8815DFF787F21FA8106760CB89C5B4493F4BD45E2CE801D2A4FE1F61DEE0C039
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.200
From: admin <admin@yingshitech.com>
Subject: ***RE:urgent Order*********
Attachment: P.O. 27000446.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PE.Heur.InvalidSig.32539.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 20:35:55 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
20 of 30 (66.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ombhcgjafeetbqlgr3hwkgoca7627nllp5wyssy6h7kojojavwaq._file
Verdict:
malicious
Similar samples:
043ba161ac2f0d30c5a15799d3ce26ec63989d278f58867aeff64ce7ecb41f42
FormBook
34c443f1958966963f6976bd37eefd299c17dad91759a54166e3056da8f0ad0e
FormBook
58933d7bb0147da562d240bc3c9974ecaa552f35495a773345e1e7d158f39588
FormBook
6790e06e433d6df6123631a9af6c9fc399b1811072284d2164671b063c640a33
FormBook
7a755f37dfb67f9ee5f00330aeb01fc6262adc740d610549dbb2ec83e99a2618
FormBook
8df71043e89088e65c08e918cdd0d0278e78ce39d3d22e04e0310c3d7ec50b28
FormBook
942040aa151db7981d1d09c3cf264df1ada08805011a4720812016bd231048a7
FormBook
af7b3fa36f4f307300ab9a8dc34806cdcf9fce5fe857e9f1b2ddc8e6def9f518
FormBook
b7a6133cc3253f40c306f93cd28219a26d1354e7e360be9014c46ee3f7f67053
FormBook
fca6ebdeec0b760f2faeef8ba5edf6ab9d0141475b5f554ef1678aa4426baaac
FormBook
+ 5'066 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-syvexr46m2/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.chilogae.com/mw9/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe 7302711920290930c1668ecf6519c207fdafb56b7f6d894b1e3fd4e4b920ad81

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments