MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89c61ae874590337a9538aeae605e8350af374e4c442a46f487f44b11d532915. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89c61ae874590337a9538aeae605e8350af374e4c442a46f487f44b11d532915
SHA3-384 hash: 351830eac38f96e6b2ee2025def77feef1728e56964e8c930672c655fb56b6747cd4da3f0b14d4741f8fe14937dd8deb
SHA1 hash: c3842ea8774c15807879f77d119b3225b3357ee6
MD5 hash: 9367350c3d7264cee61be7a14d3986f0
humanhash: one-one-ceiling-pizza
File name:RFQ.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:290'816 bytes
First seen:2020-06-26 08:00:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:X06pwaF30dIqJbZNeVI7thjh3AisnKXXM4QH3pzl4NfT7jTv:EfaSvJFNeUtXAioEXuTM7
Threatray 5'103 similar samples on MalwareBazaar
TLSH C554F10467AC2B17E6BA97F80A64300457F9A63A7563F7485FC6F0E941E1B90CB40FA7
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: chieu25
Sending IP: 45.127.62.33
From: travon@lizhenglc.xyz
Subject: 발주서_2020 06 26
Attachment: RFQ-발주서_2020 06 26.IMG (contains "RFQ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/14729/
Detection(s):
SecuriteInfo.com.Generic.mg.9367350c3d7264ce.23580.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching the process to change network settings
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/89c61ae874590337a9538aeae605e8350af374e4c442a46f487f44b11d532915/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 08:02:07 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhdbv2dulebtpkktrlvombpigufpg5heyrbki32ip5clchktfekq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
116078d29890c8b0d748b2f2709d2768f7ad9ac04688db1f44189f019f62050f
FormBook
56b9fd1bd9c1f7466020c1c2fed5d4bbbf1394c711921e91d8dc74fd7c6862a1
FormBook
7aaba6dcdbb2649a4beeb5e877f26e4ff90aa1c59cb289620dc0098ec88cc663
FormBook
7f7f93ae7c3ce6bd7d154c2e2188bd39c7d511df8fc890e46085afc34acdba2b
FormBook
8347dcd8992d73ce59c612f2c59381d084fb88fbf2d30f167e95c8ddd4818dad
FormBook
a58e85fa61d98c70d0f6bf421b73cf73709f36e77578fd52fc05cc85b4dd5419
FormBook
d338523f3836e958ad511ae3cca005a255a43bcc684174bf5928246fd477f2cc
FormBook
df8b72fbc5b86764cdbd998a0cbdbe404f3253f1a51029d5b46a778feb4839a1
FormBook
dfa8fa537be02efde6add76862693fb2f099e3339798cc1d05a2feff5409ab86
FormBook
f68b09a8adc07e084eda2fa581e9111716bb34bcba0565da70bda46860ce7c64
FormBook
+ 5'093 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/200626-bwpyj8zpkx/
Behaviour
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 5f7a920d0bc146263e6b750bce8670beabbab194cc27ee0a79b00515ae6ad812

FormBook

Executable exe 89c61ae874590337a9538aeae605e8350af374e4c442a46f487f44b11d532915

(this sample)

  
Dropped by
MD5 2be23b96114487f6ee5359ecf5b1575b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/14729/
  
Dropped by
SHA256 5f7a920d0bc146263e6b750bce8670beabbab194cc27ee0a79b00515ae6ad812

Comments