MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2e2d811f76b6fbf938e5f2721629a1feb7c409c5339961499c8500af68eb2a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	a2e2d811f76b6fbf938e5f2721629a1feb7c409c5339961499c8500af68eb2a2
SHA3-384 hash:	9bc1dfcc1f1dba05b7af7d73c1c78f9adf8c68183b2ca51b4e88acbddf4b9aeb55a93b6e4d453cc8937dd840063577f0
SHA1 hash:	9475921377bc313a882650a5519dbad490e0c330
MD5 hash:	a273c3fcf7213a18f5324b1410c5fbc6
humanhash:	sierra-oklahoma-oklahoma-india
File name:	Lists.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	431'104 bytes
First seen:	2020-06-04 09:04:02 UTC
Last seen:	2020-06-04 12:14:05 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:+aUDG3Kp166VEJD6LpJVdBWYwTl4eciOV/fj52ocxBR1Nm68:+aUDdy6VEt6pdBBQy52ocxbU
Threatray	5'111 similar samples on MalwareBazaar
TLSH	3C949D26B942C036C16D0173642E6BC1D93B1E1637869B1F73AF23189F534AB7B2562F
Reporter	jarumlus
Tags:	FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Malware.Formbook-7399661-0

Gathering data

Threat name:

Win32.Trojan.FormBook

Status:

Malicious

First seen:

2020-06-04 09:38:24 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ulrnqepxnnx37e4ol4tscyu2d7vxyqe4km4zmfezzbiav5uowkra._file

Verdict:

malicious

Formbook

52f217cdebe83217297bedc352fac2e475e293e6cad52a1335b3641eeb8c412b

Formbook

8909f47d9db9c66a8ee7b08cf9dad1551e905d48b76f4c3a2acf926c26752ee7

Formbook

8b6267e9733bf74cb555493e85cfe2391d3ca07a94d054421b0bb76a1d892a7c

Formbook

8e9f882576a66be70ed5bc204584037087f3bd53d13498126153fb7514f7dd7a

Formbook

9c3dd49a5833197c8ded3093df9fa770129e196acf76de5a54ae3ae3e9580cb8

Formbook

a492b017c3e12fe55493c562ed1304155616cb61b24f6dce0bfcd3eb7a7bdaf5

Formbook

b3b093d992d26b0d21a61a778598abd5dd87649a89f724c2798f60f9dc19de1a

Formbook

c3c1461122de17b3d35baedc41816f3df777c4d5cc67507151a9741b14407aef

Formbook

cd1a9b8d7f8d830bcb13548fdd9f02a7fae07b7c49fd12bd1a7e02ed346bc010

Formbook

+ 5'101 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook agilenet persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/201109-l8yns1t1px/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Drops file in Program Files directory

Suspicious use of SetThreadContext

Adds Run key to start application

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.glamotd.com/t1s/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator