MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb87a6186306d0417e723b3ae04b70193f32d8b5fe479de840ed10f243234c4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	bb87a6186306d0417e723b3ae04b70193f32d8b5fe479de840ed10f243234c4d
SHA3-384 hash:	ae4aba74cf19fbc4f69a6b62bc48beea72dbf13f509d645a639441240511ee8108c27b8f9fa7a976b997a09ba9f637c7
SHA1 hash:	9012abb3348157a174400a8c186a40a6a37062d9
MD5 hash:	97325e3e1075fa91ea8f279a9462fa8c
humanhash:	lamp-south-paris-cup
File name:	QUOTATION.exe
Download:	download sample
Signature	FormBook Create hunting rule
File size:	350'720 bytes
First seen:	2020-06-17 10:48:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	6144:RrbBsPWoPqUR0Dqy3v5hB5qGetrnD2ZNMsSBqR5+a0Fo+nYxyBdC1WYG0T:RrbBseoPqjDqu5hWn2ZNMjs9rxUYG0T
Threatray	5'193 similar samples on MalwareBazaar
TLSH	9474AE3C42E47A13D67E4379D097010CA2E6D2E71A86E78D9F0251F92A0F35BF97225B
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing FormBook:

HELO: vps.tiantuct.com
Sending IP: 45.95.169.92
From: PMRG LTD<info@tiantuct.com>
Reply-To: fra_white33@yahoo.com
Subject: QUOTATION
Attachment: QUOTATION.LZH (contains "QUOTATION.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/19519/

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Wacatac

Status:

Malicious

First seen:

2020-06-17 11:36:21 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xod2mgdda3iec7tshm5oas3qde7tfwfv7zdz32ca5uipeqzdjrgq._file

Verdict:

malicious

FormBook

1ebe8c4369b01611d9c49ed8aadbbd36de80d306532927b21b426dd0e648f3f3

FormBook

67c174f4fdeb4a63472a22bb21de9d1b472da3521dcfa4ba8b285e25e1f1fa26

FormBook

6deceb88f30de5953a4a9de2fd70415302205f306cdf62e14c922fee23ea721e

FormBook

8c3ab3dfe110988d790808121453336342297777bdac96a10d317bab2b0de2c6

FormBook

9586c7e95bd2c4807b9e946ac4fd97e646ac9dd52b4afc781fa85af04c7a92dd

FormBook

a601e4a16b16f0eacedc679e3f367d990c0cc913470d138b4d3e6d3ba156f7b7

FormBook

a8fb290af4d6f3cb59e034cfb61e7c6981f246c98c1929b35302bca73a05a472

FormBook

b7080e861acf13e24b0f995a17697390e262fd128de58e12e99074531ab3963d

FormBook

fe12007b316eaa8d4ef08266bcd9aa166e3cad9d5e7ac3760adfc13a655a8e7d

FormBook

+ 5'183 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

persistence spyware evasion trojan

Link:

https://tria.ge/reports/200624-zf5xs7p5gn/

Behaviour

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Suspicious use of SetThreadContext

Adds Run entry to start application

Maps connected drives based on registry

Checks whether UAC is enabled

Reads user/profile data of web browsers

Deletes itself

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.