MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a658844624b4f1c5dd792ba527d7f04945aac9be928febf34813b3028deaf0da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a658844624b4f1c5dd792ba527d7f04945aac9be928febf34813b3028deaf0da
SHA3-384 hash: dd0b3b27d69d4adf76541d75cb791d9f014d54a05ed976b660724dce2f48d7ded8382e0e78c353ceafc9a1d77edb2e71
SHA1 hash: 9406de969637630707090b17bc834332ec694f1d
MD5 hash: 1c13b6cfee3a64a5697b4a4765cc5fe9
humanhash: neptune-india-nitrogen-oregon
File name:zRnk089JOHM3WEh.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:293'376 bytes
First seen:2020-06-23 07:34:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 6144:CllceLn/56CjrQp/DWxNq2nxAmh8pDpjBK3kWZMZY/iMQ6AG:BeL/gp7Wy2usUtjBK3Rj/QG
Threatray 5'123 similar samples on MalwareBazaar
TLSH AC54F15177E81339FAFA8BB809B15050737B726FA676D55C898C608E1B2BB818543F33
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12910/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.51012.UNOFFICIAL
Create hunting rule

Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a658844624b4f1c5dd792ba527d7f04945aac9be928febf34813b3028deaf0da/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 07:36:05 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uzmiirrewty4lxlzfosspv7qjfc2vsn6skh6x42icozqfdpk6dna._file
Verdict:
malicious
Similar samples:
0a18c476254735864b8ab07e5223bb310207954cce179c4b773345d73247113f
Formbook
3a65203b683e8f50436aed7a76531617e566c4363ca795885683479e4a3430b6
Formbook
46d500e1f512e941b4c282d92908fb244439bede7a604381f761823d66f8ba2f
Formbook
6f827b68129d30609057c2e6b36be05649fce91d6bc8ee3d3566ca5c6aba562b
Formbook
b1809788389e6fbab24abc12b306b2cd4d88a59b983b5a469a63d923e572fa6b
Formbook
b42bb3af52ae6b9fc8dd890fea86abad727db5ae0647217d2f5f2035bc5c2c7b
Formbook
cd120b25b52e7720424139783c7b18f496b07f5bd8f3d4c52ea8b149318da5de
Formbook
d571629d266c5354146cdfe698d79c88c33e598aa6c8d9a0587662c6b5421ed2
Formbook
f62545db6d573b7145c40ce57f9d85eafaa9ffd95923178d29a02845def94b0c
Formbook
feb3b84e0ea9e1c3522e9a3258f8578ffe461a43ce41920d6b41fa19520ac7a2
Formbook
+ 5'113 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
trojan spyware stealer family:formbook persistence
Link:
https://tria.ge/reports/200624-h1jhdc8l62/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Deletes itself
Reads user/profile data of web browsers
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz f90c2be4568875831fa77b5cddcf4f5e6cc71e19472ae94421912e70aa2227d2

Formbook

Executable exe a658844624b4f1c5dd792ba527d7f04945aac9be928febf34813b3028deaf0da

(this sample)

  
Dropped by
MD5 5f30471a6035253cd0767851621fa4f1
  
Dropped by
SHA256 f90c2be4568875831fa77b5cddcf4f5e6cc71e19472ae94421912e70aa2227d2
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12910/

Comments