MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 972dbabdb87df7e564d3b5162d94d22ccb326a6f6d2150f3a9b29bc32e8feb32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 972dbabdb87df7e564d3b5162d94d22ccb326a6f6d2150f3a9b29bc32e8feb32
SHA3-384 hash: e86b3657e59f8acbe9857d836fe144462e7cc9f7e54fc11f8e4757ec916816952bd7174f8607094b8c9102946a2e0d28
SHA1 hash: fc207bdb750879d0d7cd66ef2520b64378af5d1f
MD5 hash: 6b9b5f5019a647d3366671280ebd5608
humanhash: jig-georgia-beer-eight
File name:DHL AWB#16062020.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:328'704 bytes
First seen:2020-06-16 05:08:57 UTC
Last seen:2020-06-16 06:12:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 6144:5Gye+qLK4ey3++/rBYOGahDwCAU0vzwakjesotHBlZFXg4oz4FP:5GyeM4ee/2Ors5LwzSsotHBlZFXg8J
Threatray 5'439 similar samples on MalwareBazaar
TLSH 0764F12CE28C8362CA7D077D84E1102443F97DA73533E65E5EC431BA6DB37E566226A3
Reporter abuse_ch
Tags:DHL exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: antispam3.ctm.net
Sending IP: 125.31.5.76
From: Zhen Xing Yang (DHL) <yzx@macau.ctm.net>
Subject: DHL Express Tracking No. 7177009070.
Attachment: DHL AWB_16062020.IMG (contains "DHL AWB#16062020.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10548/
Detection(s):
SecuriteInfo.com.Generic.mg.6b9b5f5019a647d3.27071.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:10:14 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s4w3vpnypx36kzgtwulc3fgsftfte2tpnuqvb45jwkn4glup5mza._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
08b47c6d183afb72f383ced4639ba73a03d9b36f06617585b3a3d28b69d1ce9f
FormBook
1c22bad3a6eb408ec1f4d6ef50b04e2294a77979abc411f9dbb752e2b495345b
FormBook
1fa61bb029466f4fe3ed9385994dcaed8b25715931e460f9b4db88ec155ec6a3
FormBook
3a623059d68483ec267fb4852e1209eb93c3f351ba976cc1ef92da7070c33c64
FormBook
55b3e07647dc14ce27a256bce50140daccd1dcbd05e7d26b516a2a31abd5d9f7
FormBook
783c6835be34af1803983890ec14e1edb2ac7cef4442dff43cddb719d97236b2
FormBook
7c479cfb9c3df15b565e16fc62709d8af849773c5112b53bf4d41f939219d6d8
FormBook
7d667845924245b2c6acee25a643afab5ad0a822614574c93cbf19ff0bb4f8c4
FormBook
80d185a291cf5c72cf84c63a49ade7e9d7363a3721aa2967c9d143c7d29fa03d
FormBook
c8106842608e4f4300a6fe2f369914e6ff67013c4c66edf42a0b54bdd55f5c91
FormBook
+ 5'429 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-b8hd87myce/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
rezer0
Formbook
Malware Config
C2 Extraction:
http://www.norjax.com/hxb/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img cfcb13ce9e21790b5f25d0d51c6e300c019956eda03f6d41ab857f9eae8e3a68

FormBook

Executable exe 972dbabdb87df7e564d3b5162d94d22ccb326a6f6d2150f3a9b29bc32e8feb32

(this sample)

  
Dropped by
MD5 ceb5155bffb5faaedefcfba3a3f76d95
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 cfcb13ce9e21790b5f25d0d51c6e300c019956eda03f6d41ab857f9eae8e3a68
Cape
Cape
https://www.capesandbox.com/analysis/10548/

Comments