MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8319e58d392d571380931f7b06155190f296ce4f2af54af1f0fc2383f8569c4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	8319e58d392d571380931f7b06155190f296ce4f2af54af1f0fc2383f8569c4f
SHA3-384 hash:	0ac3259d75d56187200a97c1386e73cf57f900395114b8fa518c89d17547c9406c9ad3ac2c226b28412d0133ffc14526
SHA1 hash:	22abde5c3c5ad1fe1aa60198028b236966942d11
MD5 hash:	b2a80a67249ee6a96982faa9327f7a31
humanhash:	ohio-orange-maine-speaker
File name:	RFQ-Cona Import2020112.exe
Download:	download sample
Signature	FormBook Create hunting rule
File size:	519'168 bytes
First seen:	2020-06-29 06:21:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:8Fh1M+/f/qChzROUPHl8+dYLrzMA0sIz1YPzSn7HYilED4gyTW:SHZPq3r5UtHL/
Threatray	5'175 similar samples on MalwareBazaar
TLSH	4BB4BE14A7A98FA3CABC97B14961D5304BB22EF67C35DA0D9DC274EF0B71F504A90923
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing FormBook:

HELO: mailer.digitalterra.life
Sending IP: 142.202.188.254
From: Cona Import <varitron@ms15.hinet.net>
Reply-To: david@kelichna.com
Subject: RE:RFQ-Cona Import2020112
Attachment: RFQ-Cona Import2020112.rar (contains "RFQ-Cona Import2020112.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/15376/

Detection(s):

SecuriteInfo.com.Fareit-FVR97B1CDB35EA0.28661.UNOFFICIAL

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/8319e58d392d571380931f7b06155190f296ce4f2af54af1f0fc2383f8569c4f/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-29 06:22:07 UTC

AV detection:

23 of 28 (82.14%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qmm6ldjzfvlrhaetd55qmfkrsdzjntspfl2uv4pq7qryh6cwtrhq._file

Verdict:

malicious

FormBook

50f8d8b5cbbad3f2a1d4a25b84553ba285f49318ab3dbb8d436b6709582997e8

FormBook

597022d4e4794fb02c89a43939d93d1b2b1140e798e355c2a53a8423f19514ad

FormBook

6b17c7fa9318e19b00115ee75af6c8ee3b811e7983ed96ae819461482834137e

FormBook

8e0003e4f6d537153e60ac5129859a33b57b3b9a36b7d2be62273a6b3a8d5f3f

FormBook

968caaf20d88166fb2ea2774f772f36a4f070bd6d912f8a1c46c0ae4cd3a31a7

FormBook

a841d5eddb5208f4740c9d305151742f0a4c39b113e91d41414af98ff19c6c3d

FormBook

aa96ad04f8d5fede0038fa00238b1c5a275decf0774dadbfd93922311f80394d

FormBook

c581c0cb91f2bc8e043a9132e704adb5c36147bb4d1a60676bdeb0c8d3686beb

FormBook

dce6cefe7a650b400f2b26826f5b26d6ac2092261856c8e81d30e8b8e0b47249

FormBook

+ 5'165 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/200629-dspgbzz9cn/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious use of SetThreadContext

Deletes itself

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator