MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4f6a523d411d3407372f81a18fe32a078e36c3715cf3b88f60fe05e6eb37fba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4f6a523d411d3407372f81a18fe32a078e36c3715cf3b88f60fe05e6eb37fba
SHA3-384 hash: 4066596ba038d9038ec3af66cc499b0630efba2dff6599304cf47de4eb94fda97519d9fd8e371c5cc20964924ba879c0
SHA1 hash: 56ae58f598633287cf6f52f30ed0213214006b83
MD5 hash: fc1be6b35e91e0b390d2816fc2a47ec1
humanhash: spring-nebraska-oven-hotel
File name:UPDATED SOA MAY 2020_pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'217'024 bytes
First seen:2020-06-08 07:18:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:ytb20pkaCqT5TBWgNQ7a+WZZw+OTFDL6A:/Vg5tQ7a+ce/5
Threatray 5'990 similar samples on MalwareBazaar
TLSH CD45C01273DD8361C7B25273BA16B701AEBF7C2506A5F96B2FD8093DF820162521E673
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 48.ip-139-99-90.net
Sending IP: 139.99.90.48
From: emkl-import@keceline.co.id
Subject: hotel
Attachment: UPDATED SOA MAY 2020_pdf.xz (contains "UPDATED SOA MAY 2020_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 07:20:07 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6t3kki6uchjua43s7anbr7rsub4og3bxcxhtxchwb7qf43vtp65a._file
Verdict:
malicious
Similar samples:
02b10c6690bd0ed3e9b675553519df78a7ede63a398d68304043eacb691fd305
FormBook
1edf8c6bcf0ae2b38e9e28bcb1fd838c2ea35b5b126e4bc9e42daa2e1e722298
FormBook
68739817fe82121fcedf1092eca699f59941678ddd9622062c8d40c200bef82f
FormBook
720f6f2a125359d8b85eea767c95d0059cb46eba2fc05a53bcfbf73b5bfc8531
FormBook
72e42f1672249fbd4db20c17d5e29fba5838ef08cf0f6964d84ffc434ea46f27
FormBook
76bf9fbbf199cdbb2c42d49a7d200e2c9b325fdc1c4ad2de205f40331a017243
FormBook
8ca9ad9aedc2d32e50609ca807c71c459560d63b78c9022d7b6d9ad480d19498
FormBook
9465c69c18144431c36b77e4b36534684c7717f1d9970eb522b8aef716dd2458
FormBook
c9f7661a1a814820db663d5a916abd38a6c824429542e8b833c9a4e67974ac80
FormBook
d3664113994262962936ebe74d0355986970def0cd0bcdcf088fe102047df9ba
FormBook
+ 5'980 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-n2mbbyadga/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of UnmapMainImage
System policy modification
Drops file in Program Files directory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.glamotd.com/gm1/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

xz 5eda74355322b300eb8dc5a8e1f230330b826292723993bbc8eb7eed58ceca54

FormBook

Executable exe f4f6a523d411d3407372f81a18fe32a078e36c3715cf3b88f60fe05e6eb37fba

(this sample)

  
Dropped by
MD5 402eacb5a9b74ea61912ddfb03c16da0
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 5eda74355322b300eb8dc5a8e1f230330b826292723993bbc8eb7eed58ceca54

Comments