MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e95f01bbde0fbd70670b820b972768e7fc5f23509495c805ddbc3271030f443c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	e95f01bbde0fbd70670b820b972768e7fc5f23509495c805ddbc3271030f443c
SHA3-384 hash:	88ab84cd7e5cf0454f83bc85ba5460d22cf09b9b11095412c5db56ed464584f7eb10a0af1aa788997ea7e667df599d81
SHA1 hash:	8ee0d777616fa968e23bb7ba70962729b2e2295b
MD5 hash:	cfc84703691c6640926457cb908b1b48
humanhash:	bacon-ten-burger-green
File name:	New Order list.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	377'344 bytes
First seen:	2020-06-30 12:32:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	6144:h5boPjsbPX61e5KdLfpuCN5bM+lh4hHk5DkxKo9GrkmmpD5yh/ShB:h5boPobPZQVfwz+lhl5k4/gnpD5yh6hB
Threatray	5'361 similar samples on MalwareBazaar
TLSH	0084E170B265DAA9ECB683B45859DC200FB2B55FA070D30D39967AAE58F33521173F0B
Reporter	jarumlus
Tags:	FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/17143/

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/e95f01bbde0fbd70670b820b972768e7fc5f23509495c805ddbc3271030f443c/

Threat name:

ByteCode-MSIL.Backdoor.NanoCore

Status:

Malicious

First seen:

2020-06-30 04:51:05 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5fpqdo66b66xazylqifzoj3i476f6i2qssk4qbo5xqzhcaypiq6a._file

Verdict:

malicious

Formbook

017f433a49afcc765c5a5e7f39de6251fbe37d9c98f7d86f1abcefb1a9f559bc

Formbook

41519f4cbc28650e8151b62f9a6b9503274a80d6dc51bade4a118812742e63ab

Formbook

61ce52bb7cf517275e2bea379104a392630ec8dc216790a910f4586efbdca4fb

Formbook

86d0178097eebb5010e24650ce79f80f19567ad2872f0f0b7325761a01cf67f5

Formbook

8afd54f2ed0af6d9593b0985cec1604748ca753900859fe4ee225d21b574e55e

Formbook

91ff383b66f03166257bbf629acfab862c2269e04b76bc49714520a5709e5e72

Formbook

a6534d12c87d0d8093cad2787b01a05c6caa0771f1b1cb51b809ee1ae9f48044

Formbook

be29f9be4b998a7893c2c182c972406067eaf913364484a1fa824133d71ef54f

Formbook

c5ccddfa0f7ee807513279b0195460cd48f3b36f2154c93ff3945fe30c647dde

Formbook

+ 5'351 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200630-j53cclk856/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator