MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d338523f3836e958ad511ae3cca005a255a43bcc684174bf5928246fd477f2cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 6

Intelligence 6 IOCs YARA 4 File information Comments

SHA256 hash:	d338523f3836e958ad511ae3cca005a255a43bcc684174bf5928246fd477f2cc
SHA3-384 hash:	5505676d68d7925c8f5e5b7c14569159b9ad3982c8fb7af6afa963d36ae10dacf8f95cec6484d2f62eb6dd2af5f109c6
SHA1 hash:	c26c928df59de463369f090d5132a9e53a2ebc1b
MD5 hash:	ac34c149a0159e67812804a5b3b73854
humanhash:	echo-solar-two-oregon
File name:	ORDER.exe
Download:	download sample
Signature	FormBook Create hunting rule
File size:	359'936 bytes
First seen:	2020-06-24 05:13:08 UTC
Last seen:	2020-06-24 05:53:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:re1Oe8lpBmMpY5q2mUA79Ht68TxW0YCmeN2BM1y1HO7n2mr:y1ClzHEqZJhlYCmeN0AExm
Threatray	4'838 similar samples on MalwareBazaar
TLSH	FA74BF7051EE06B2F32BCB31267DBD5047B1F2C797C2EA4C076DE2A21BAA7516F4054A
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing FormBook:

HELO: ngay23
Sending IP: 45.127.62.25
From: 임성빈드림 <madie@jenifereddleman.ga>
Subject: SLP 하이퐁향 LDPE 판매계약서 드립니다(SOL-202006-13)
Attachment: Sales contract-SLPSOL-202006-13.IMG (contains "ORDER.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/13363/

Detection(s):

SecuriteInfo.com.Variant.Razy.700311.23746.17881.UNOFFICIAL

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/d338523f3836e958ad511ae3cca005a255a43bcc684174bf5928246fd477f2cc/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-23 23:39:18 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2m4fepzyg3uvrlkrdlr4ziafujk2io6mnbaxjp2zfasg7vdx6lga._file

Verdict:

malicious

FormBook

56b9fd1bd9c1f7466020c1c2fed5d4bbbf1394c711921e91d8dc74fd7c6862a1

FormBook

7aaba6dcdbb2649a4beeb5e877f26e4ff90aa1c59cb289620dc0098ec88cc663

FormBook

7f7f93ae7c3ce6bd7d154c2e2188bd39c7d511df8fc890e46085afc34acdba2b

FormBook

8347dcd8992d73ce59c612f2c59381d084fb88fbf2d30f167e95c8ddd4818dad

FormBook

89c61ae874590337a9538aeae605e8350af374e4c442a46f487f44b11d532915

FormBook

a58e85fa61d98c70d0f6bf421b73cf73709f36e77578fd52fc05cc85b4dd5419

FormBook

df8b72fbc5b86764cdbd998a0cbdbe404f3253f1a51029d5b46a778feb4839a1

FormBook

dfa8fa537be02efde6add76862693fb2f099e3339798cc1d05a2feff5409ab86

FormBook

f68b09a8adc07e084eda2fa581e9111716bb34bcba0565da70bda46860ce7c64

FormBook

+ 4'828 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

evasion trojan

Link:

https://tria.ge/reports/200624-le2z1rb3fn/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Deletes itself

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator