MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14fbe673ff6885803dc45ef4966a7632d47fe9c930572b505691876c082f8322. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	14fbe673ff6885803dc45ef4966a7632d47fe9c930572b505691876c082f8322
SHA3-384 hash:	61142616f91af8684ebf7b92bd3335a6e40880b6e6deb9e72265ea4f0fcdb3c6d15bbbe6c11db2cff2f6dfe4f91c97ef
SHA1 hash:	827a891033368e99f584466b40efb504aff9c3ea
MD5 hash:	117640e9081c9a6803d8e2ed3d1fbfeb
humanhash:	uranus-venus-nebraska-oxygen
File name:	new order.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	543'744 bytes
First seen:	2020-08-18 05:35:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:cS14FFhvAqvxXdF9UWK5WpLQKmYHKP8Tocojnl4fYyhWdns3mmFh1DrrWh:cS1QbvgWK5WpLQKmYqP8TocVhb3zDu
Threatray	2'264 similar samples on MalwareBazaar
TLSH	F7C45B3239828C38E536127570286ED6FA2466447ED5CA2FA3DF97CC7F0086B7B6416D
Reporter	cocaman
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/47489/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Sending a UDP request

Creating a file

Creating a process from a recently created file

Launching the default Windows debugger (dwwin.exe)

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/14fbe673ff6885803dc45ef4966a7632d47fe9c930572b505691876c082f8322/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-08-18 05:37:04 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ct56m477nccyapoel32jm2twglkh72ojgblswucwsgdwycbpqmra._file

Verdict:

malicious

Formbook

4fd6cfb4c08338e8b3a6ec64118aa6ad90350e865e90365b5b700aa41908b984

Formbook

8067539c7f15318bf8e93b32e339c7236e3b242e8d56637f2c64f6d01c83b3c9

Formbook

9295ce88660ed117b7cfff0886232a51dc6492bf6100738957bf93fabdb74bb8

Formbook

b1c87bb82c46e28ccb5188475def1c24b3239f0508372163cd75d2abc6eaf049

Formbook

b3289e282e7c031fde98778bac0057bad5d933c85da0b43d95f177c6333fc3c2

Formbook

bf860192609c621a3b073d826266676c8d942db2a9c6e375a9e386c500b55c7f

Formbook

c62ef08103c30d5d2d18fbc2eff820985af40aa377828ef72c3ecad495103511

Formbook

d77b158058cb4a8ba8817a630e3d664e01f5f4f7cf1069d25e256b987eca1a6f

Formbook

e548234adb2b484793484466ef99084bb77854de66782af91e38420a198b4f83

Formbook

+ 2'254 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

agilenet rat trojan spyware stealer family:formbook

Link:

https://tria.ge/reports/200818-2xtjxnyyk2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.yofdyk.com/gbr/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.