MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2d60c8915d3180d7416c1c7067bb63b0002145b7dfb0fecfb2899cbabf0c274. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	b2d60c8915d3180d7416c1c7067bb63b0002145b7dfb0fecfb2899cbabf0c274
SHA3-384 hash:	523a0679aa454a5c9b6a1e3c9c20177684aa9023d9558040eba20470330294ae58842b0a2f469d22415d840e78b77929
SHA1 hash:	9ec53f2bcbe6513e8dd8297d72154378f05892b7
MD5 hash:	394b135aa54d033c75da9d3f2801aac7
humanhash:	delta-mountain-cola-juliet
File name:	New Order.exe
Download:	download sample
Signature	FormBook Create hunting rule
File size:	339'456 bytes
First seen:	2020-06-17 10:10:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	6144:I4SbGsP0QFT7vW2JiTMS1Bxp4jIn6P8e4a6cP/TIqc3x+km6FPQytKst:I7bGs57u9TvOjGm8eacXA3rFztKst
Threatray	5'422 similar samples on MalwareBazaar
TLSH	8574BF3C83E97A13D57E47B9D0A7420C93E1C1E75ACADB984B0220EB1A4A75BF937147
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing FormBook:

HELO: funimop.com
Sending IP: 167.71.125.187
From: Mr. Andrew Peng <info@funimop.com>
Subject: New order
Attachment: New Order.r21.zip (contains "New Order.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/19482/

Detection(s):

SecuriteInfo.com.Trojan.Siggen9.54526.14048.14426.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-17 10:41:33 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wllazciv2mma25awyhdqm65whmaaefc3px5q73h3fcm4xk7qyj2a._file

Verdict:

malicious

FormBook

2ff5f726080125732c91296d7bce8b496e5d50d2fb8b3d028f0f41990565015e

FormBook

58f28dd7cc2c257f5ac8dec9111d8cf8942e1cf62bb8334f4922e4b124d4eab9

FormBook

67c174f4fdeb4a63472a22bb21de9d1b472da3521dcfa4ba8b285e25e1f1fa26

FormBook

7d65c5f831361d3e7441c49dfe9e5a286c1b142fa1315c3460e144b240a2afaa

FormBook

bb87a6186306d0417e723b3ae04b70193f32d8b5fe479de840ed10f243234c4d

FormBook

c1906f759f4a2c8ae9f8823ca245eff46443a04438dfbfa82efa82247ed7421b

FormBook

cbbc3af13a3cc33ff5dffb137c7276dd246f9b9a696de51d6858461e986d4ebd

FormBook

cc8cf128220c891f74068de7a331bc70c9f7e7a141dba5afdd4eb94adfaba510

FormBook

ec3275973764fa95e7fd95628318c58c9731eeaf4a530f80e954330e8de52e6f

FormBook

+ 5'412 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

evasion trojan

Link:

https://tria.ge/reports/200624-q864yvhwwj/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetThreadContext

Maps connected drives based on registry

Checks whether UAC is enabled

Deletes itself

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.