MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb0c96dd4021c9d4f7b7f85ce5372ef74f7ba8c1a257d2c152db052020219799. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb0c96dd4021c9d4f7b7f85ce5372ef74f7ba8c1a257d2c152db052020219799
SHA3-384 hash: 6b33b17388b7fcd18d8d413a2b7345fab741d94bbfe2e35364e62d982fbef225f3e766efbd570591b3bbb65119897d90
SHA1 hash: 02946e812bc7082e8454deaa124571aa158aa680
MD5 hash: 3a92350e5c65597f42e06a910a067f12
humanhash: magnesium-violet-robin-oklahoma
File name:New Order 984994.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:506'368 bytes
First seen:2020-06-20 05:59:03 UTC
Last seen:2020-06-20 06:58:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:Fq1I5tdMIysrR1dRYn6VX0VfUyr9EG39E8kq:eIVyIrKngaRyG39
Threatray 4'914 similar samples on MalwareBazaar
TLSH 2AB4E091F6D88394E4684B7154BA24101376BC362C73E69E3D8871586EF3BC35272BBB
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vps.sandrovicari.cc
Sending IP: 45.95.169.67
From: Hamza Elsmadi <hamze@alqariab.de>
Subject: Re:Purchase Order
Attachment: New Order 984994.zip (contains "New Order 984994.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9904/
Detection(s):
SecuriteInfo.com.Artemis3A92350E5C65.16578.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 06:01:14 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmgjnxkaehe5j55x7booknzo65hxxkgbujl5fqks3mcsaibbs6mq._file
Verdict:
malicious
Similar samples:
1397dc48d497802e469f2dc1509622cc2aa0382dfe63011767eef0c5cb24e6af
FormBook
31f02d35e3e941b42298936bd026b39a5d682825bc4b4277945f9f0143617931
FormBook
4092b0f7ea14add16e6f6f35071b074458a19d4550af50a80ed5742cc7046568
FormBook
60b16ec5588cc16f4513cd9c999ec223894cef95f7b48c5b180bfcf3852d1521
FormBook
65cd6807556189c85811f11fb91a981749e7d9760e5a72c0845dd6b8ff93a8f9
FormBook
66812d316b85e20248c4af1f141a372ec1e434d951f7c6fc51402ab23da87845
FormBook
773fbca16ec67d4820654e39aaa65645f8608a8f7186f12b5ed62498ff1334c6
FormBook
89819dbac176147b14b878250b43d1954844e6f0d4bace8b4607bad4405ca96b
FormBook
8c0b9f69c227d86700be2a4dc67460fa30e46610e444a7dbe143a9bc5bda1297
FormBook
e8172cbc3806d750d00a5619e618ffc068b9d8247b5f4da507642e70e32ac3f9
FormBook
+ 4'904 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:formbook persistence
Link:
https://tria.ge/reports/200624-l2yjtmh62e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Deletes itself
Reads user/profile data of web browsers
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 89b44ca030f49c36a138e2c14f6ce2e9d88a36a610033bc310200d44c6061445

FormBook

Executable exe bb0c96dd4021c9d4f7b7f85ce5372ef74f7ba8c1a257d2c152db052020219799

(this sample)

  
Dropped by
MD5 1aa7c6c750e7fae09ae3e462e2307b67
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 89b44ca030f49c36a138e2c14f6ce2e9d88a36a610033bc310200d44c6061445
Cape
Cape
https://www.capesandbox.com/analysis/9904/

Comments