MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cc899a5fc4a3e7fe1c9d1265b60a4faf51bc1df3e4b25c088979755410fa954. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 1cc899a5fc4a3e7fe1c9d1265b60a4faf51bc1df3e4b25c088979755410fa954
SHA3-384 hash: 0c0fd4fbe859dc2f4917b41fa1602ffaa50e6dc3a7b88266f6c75250ad78f9cf424e095f23e5b62f6d0fbd8fde5edcb5
SHA1 hash: 4ecb0c52aac20465e46e46514f0e23a8bfbf83eb
MD5 hash: 4b1ad896be5b7e954882fce34bd1072b
humanhash: carbon-robert-hydrogen-jupiter
File name:4b1ad896be5b7e954882fce34bd1072b.exe
Download: download sample
Signature FormBook
File size:1'247'232 bytes
First seen:2020-06-17 06:00:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7
ssdeep 24576:mAHnh+eWsN3skA4RV1Hom2KXMmHalgNPaJWOmHja3rW1R5:Bh+ZkldoPK8Yalka4OOor4
TLSH E245BE0273E1C036FFABA2739B6AB60556BC79254133852F13981D79BC701B2267E763
Reporter @abuse_ch
Tags:exe FormBook

Intelligence


File Origin
# of uploads :
1
# of downloads :
31
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Status:
Malicious
First seen:
2020-06-17 06:02:08 UTC
AV detection:
27 of 31 (87.10%)
Threat level
  5/5
Result
Malware family:
formbook
Score:
  10/10
Tags:
trojan spyware stealer family:formbook persistence evasion
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
System policy modification
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Reads user/profile data of web browsers
Adds Run entry to policy start application
Formbook

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe 1cc899a5fc4a3e7fe1c9d1265b60a4faf51bc1df3e4b25c088979755410fa954

(this sample)

  
Delivery method
Distributed via web download

Comments