MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f68b09a8adc07e084eda2fa581e9111716bb34bcba0565da70bda46860ce7c64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f68b09a8adc07e084eda2fa581e9111716bb34bcba0565da70bda46860ce7c64
SHA3-384 hash: 024d3b244ef3c7aaf9ca9a97456117506f68ca09b9b0b2d7ee6e08b38b4902870170b3ad350074c39208d8ee184842b7
SHA1 hash: be3bf8340f4d6aff6d968e4c0f68e1cd7e917cc4
MD5 hash: 2638813001d70ad71e97327e791087bd
humanhash: sink-kentucky-charlie-quiet
File name:RFQ.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:339'456 bytes
First seen:2020-06-18 06:22:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:icSc6eTRI+hfV4LqQ74hXBSFT38Cjma4yKyP6OEo+A6Yae9:inc6eTRTaqugWT7jBzKyPBEo+A6Y
Threatray 5'339 similar samples on MalwareBazaar
TLSH FF74E1067798C716C4760B7AD4E6550003B8EA673B22E72E3BC532AD19633E35647B8F
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vitasiz.xyz
Sending IP: 192.227.72.31
From: Han-Su  Park <terry@vitasiz.xyz>
Subject: RFQ-견적 문의 요청
Attachment: RFQ.IMG (contains "RFQ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19688/
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:24:07 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=62fqtkfnyb7aqtw2f6syd2irc4llwnf4xicwlwtqxwsgqygoprsa._file
Verdict:
malicious
Similar samples:
116078d29890c8b0d748b2f2709d2768f7ad9ac04688db1f44189f019f62050f
FormBook
56b9fd1bd9c1f7466020c1c2fed5d4bbbf1394c711921e91d8dc74fd7c6862a1
FormBook
7aaba6dcdbb2649a4beeb5e877f26e4ff90aa1c59cb289620dc0098ec88cc663
FormBook
7f7f93ae7c3ce6bd7d154c2e2188bd39c7d511df8fc890e46085afc34acdba2b
FormBook
8347dcd8992d73ce59c612f2c59381d084fb88fbf2d30f167e95c8ddd4818dad
FormBook
89c61ae874590337a9538aeae605e8350af374e4c442a46f487f44b11d532915
FormBook
a58e85fa61d98c70d0f6bf421b73cf73709f36e77578fd52fc05cc85b4dd5419
FormBook
d338523f3836e958ad511ae3cca005a255a43bcc684174bf5928246fd477f2cc
FormBook
df8b72fbc5b86764cdbd998a0cbdbe404f3253f1a51029d5b46a778feb4839a1
FormBook
dfa8fa537be02efde6add76862693fb2f099e3339798cc1d05a2feff5409ab86
FormBook
+ 5'329 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/200624-pwjpggnrwj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Deletes itself
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 5c2e09280fcb0e2c0bf2c65f6e2f2656a40fb09ca969d43b80f4d27d152cbb57

FormBook

Executable exe f68b09a8adc07e084eda2fa581e9111716bb34bcba0565da70bda46860ce7c64

(this sample)

  
Dropped by
MD5 2876e67e5be1c3482f8cdbeaaf2ba358
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 5c2e09280fcb0e2c0bf2c65f6e2f2656a40fb09ca969d43b80f4d27d152cbb57
Cape
Cape
https://www.capesandbox.com/analysis/19688/

Comments