MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca1a1e6067f0780b53d1863908555e55ad98c42d8af34d00be76f656d2d9a2fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca1a1e6067f0780b53d1863908555e55ad98c42d8af34d00be76f656d2d9a2fe
SHA3-384 hash: d4b650e0a1ac88596ff28792b9c96b1a9c1830666cf2af94b89912a90a3dbbb1df5521ab37619d604df7cb37096457ea
SHA1 hash: 0fac666613403f2662ef34ceedb0168d55e10be2
MD5 hash: 06af0d3387af5599bbe5767eeb705e43
humanhash: florida-johnny-uranus-enemy
File name:05- 06-20INQ.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:449'024 bytes
First seen:2020-06-15 06:33:38 UTC
Last seen:2020-06-15 08:24:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 6144:MaUPS76VEJD6LpaktYuI26ZA7oPyUicmqAM5sD0JbsnYS2:MaUI6VEt6LX0ZAYy1qASsDMbse
Threatray 5'109 similar samples on MalwareBazaar
TLSH 53A49D3672829039C16D4272A0795FC6963A1E113681AF1FB3FF23485F4369BB72671E
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10276/
Detection(s):
SecuriteInfo.com.LuhePackedH.15127.31606.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 06:35:04 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zinb4ydh6b4awu6rqy4qqvk6kwwzrrbnrlzu2af6o33fnuwzul7a._file
Verdict:
malicious
Similar samples:
00983a8176276beea115d21fef7919c49b29b96d78dbc2151cc04cc7d8c95b35
Formbook
0d271903774ae9467d80cad6fcaec4d2ea4653b8eb4c28e0a1c7dbe0849ccd01
Formbook
16de0aa2d02fae6460bb173c9104df4fa758343ab226aea79a3910dce19fa58e
Formbook
1c22bad3a6eb408ec1f4d6ef50b04e2294a77979abc411f9dbb752e2b495345b
Formbook
3a7e2e98243c188fbda3734b22856c30febb41d1f7e0ddbc034906288aa72dae
Formbook
52e01cac4f5319a7d1177aae77861b4ad8f77b26581d089e948344d0e608b80b
Formbook
590fde182a154cd89b15d88546d60351b9fecb51e04fbbf4affd8d49a618bd23
Formbook
5c5e4e31bde29168e03fa8cce36bab9b577568137edab59f68f8968616546ed9
Formbook
c7544c2d4180660fc3a96f3b66b5caa0e168dcfbb35a870f1c576a152ed62348
Formbook
f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e
Formbook
+ 5'099 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook agilenet rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-ebl7clvmqa/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.sudelt.com/rk3/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

3c04fbb4e7a36b6fd1be6d84fa771372e7640f339da73ebb2b094104617ca017

Formbook

Executable exe ca1a1e6067f0780b53d1863908555e55ad98c42d8af34d00be76f656d2d9a2fe

(this sample)

  
Dropped by
MD5 48637500fd76fc04bc7876cb80687da7
  
Dropped by
SHA256 3c04fbb4e7a36b6fd1be6d84fa771372e7640f339da73ebb2b094104617ca017
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/10276/

Comments