MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8efac0f1a783fbe5627c1fca4c211583bf045bd5671d89df9418220d66078c11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	8efac0f1a783fbe5627c1fca4c211583bf045bd5671d89df9418220d66078c11
SHA3-384 hash:	e90f5eff5bd126f25318c118f527216b47bc29d8fb2c9ecd85b959d69eab3b2790404667aa95af4080c64f7d6bdac823
SHA1 hash:	5393cf369b6a3577c195339680f97eac0d7248aa
MD5 hash:	cde2c4c399ad674bdc2a8e0d055ce60c
humanhash:	magazine-december-bluebird-hotel
File name:	CONTRACTS.exe
Download:	download sample
Signature	FormBook Create hunting rule
File size:	336'896 bytes
First seen:	2020-06-05 10:05:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:RU4nzxxLd/qp0Wcm2Mm8ddQvsgMcUpj4ky:19f/qp0Wcm2kOJ
Threatray	2'245 similar samples on MalwareBazaar
TLSH	3F64BF2193E8971AE2AF9BFCF87144654B72AD16DCB2F75D423874EA28733809841377
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing FormBook:

HELO: vyapartrading.com
Sending IP: 95.211.208.25
From: "EXPORT"<export@vyapartrading.com>
Subject: CONTRACT & PROFORMA - 50 MT of Raw Cashew
Attachment: CONTRACTS.zip (contains "CONTRACTS.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-05 01:08:30 UTC

AV detection:

23 of 31 (74.19%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=r35mb4nhqp56kyt4d7feyiivqo7qiw6vm4oytx4udara2zqhrqiq._file

Verdict:

malicious

FormBook

3f86f49f3c2e3583c70385971bdba545c85d8f2d66f8923bf446dde88be3afc0

FormBook

4c1fe4c0f5d8d1277036802c83df3e083b31318dfc2c194ce93b7169d7ba6e3d

FormBook

6348a886a9796d2fa05cd1792d8299c1a3a66e016b04a115e34c47d49415714d

FormBook

6f3cf19b51263af0e6b7e8856a7d635a44dd101e069b84f5ceb11778a81cbf35

FormBook

7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6

FormBook

99cd867e1595504f909e1e040664433574b9b3884d21d4e5c1f42fa1f14764e3

FormBook

a6009a6b0724811f3bb71fc6f0c6b3b1aad71448948175949c7eb8af82034e91

FormBook

c1b2a36d08dfb9bc18d53112299e6cef0c5057885918a4485b8f1b87a20d709a

FormBook

e273d82c782a01c388cc619e6832bfb43301f4308884751b9393262302fc84c0

FormBook

+ 2'235 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/201109-elzk83e6f6/

Behaviour

Enumerates system info in registry

Gathers network information

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Suspicious use of SetThreadContext

Adds Run key to start application

Drops startup file

Reads user/profile data of web browsers

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.salomdy.com/nfl/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator