MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a4f12beb7153b4365384e8918afda0d14d33bae8fa32ce8be01c4dcbf08529f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a4f12beb7153b4365384e8918afda0d14d33bae8fa32ce8be01c4dcbf08529f
SHA3-384 hash: 79ee9657d26c82c1b411cac27138c7ad2c4784699f4cfb939051b7a65bd25ac648b163c631a3f495b0c8f603825d56aa
SHA1 hash: 9e68c391c0ac63b1f2dad8bb58921fa7b6dced68
MD5 hash: ac9289ac733e15a5733cb0a89bfa3a92
humanhash: oklahoma-wyoming-robert-texas
File name:Picture1.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:696'320 bytes
First seen:2020-07-03 18:04:01 UTC
Last seen:2020-07-03 18:49:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3dbf6c2cd2886e109ef90dcce86638b7 (5 x FormBook, 1 x NetWire, 1 x RemcosRAT)
ssdeep 12288:ce7+LHvP79bjBoxHyzKXAzgqGD4zdCIJuxd6Ur5IScz5ISF+gAuA1KzqrRUyqqjt:Tq779bjBoAzKXAPC4iYX/ebP24cjc
Threatray 5'127 similar samples on MalwareBazaar
TLSH 77E4CF21B3D0953BDD5B1BB48C0F6AA86C267DA02E99584F3AF81CCE6B7D361342D153
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18779/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a4f12beb7153b4365384e8918afda0d14d33bae8fa32ce8be01c4dcbf08529f/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 18:05:06 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tjhrfpvxcu5ugzjyj2errl62bukngo5or6rsz2f6ahcnzpyikkpq._file
Verdict:
malicious
Similar samples:
0211865d58af36be2009eb29a77a400355a4cb7b8542d6359a6fa304c3f7d935
FormBook
03cba0b3813108ec932306f5aaa9d152603a834b9caf3c601722a9cda41ca194
FormBook
0df0a487b38b5d9bdbc8e2c05ba4c639dfe09969f5f68c85da43b46c16a48f6b
FormBook
0e7ec69a6222b2753c0167997838b380acfd47834a6d1e7dd2475fd4fe07d63c
FormBook
18dc7ad4fd5ffd0ec8b8f12884b41f3ace4e2ba95f704175ebf0a0eead74ba36
FormBook
1f6b6d481b672f8ed428a044ebffa9e16424317c0081aad3c00cb61a547b90b5
FormBook
560c76df97fdc5816fa9310921082a04b44b781e60bc77f84b970df04a36d1f4
FormBook
a696a4e34ae22386e2759a75b90f5990501c2cbbb529036f8ec124b8fb9f6c77
FormBook
cac635b83d0ee884f8d8bbce419b4c9d13273f4a10c450c2ea50830dc683e3ac
FormBook
ea12fb909266d6a6f7315c8ffe0fcedb6b63ba660cd91e7c2ac4e6db14596171
FormBook
+ 5'117 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
persistence evasion trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200703-8p287ybq4s/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Legitimate hosting services abused for malware hosting/C2
Checks whether UAC is enabled
Deletes itself
Reads user/profile data of web browsers
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe 9a4f12beb7153b4365384e8918afda0d14d33bae8fa32ce8be01c4dcbf08529f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/18779/

Comments