MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 218a43f5f1a1bb3a7974fe8fd0532829b1b858dec3c8d6bc2a5835a6bb735321. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | 218a43f5f1a1bb3a7974fe8fd0532829b1b858dec3c8d6bc2a5835a6bb735321 |
|---|---|
| SHA3-384 hash: | ecc218fcb543cd52a1179c6f5e57d55109d583dd151fc11e1cc5edc89d88dfa066e25360ffb97b1358272e3bfdeab112 |
| SHA1 hash: | 4a01fcbced1e4234bfd10ea8980b6c65684f3b28 |
| MD5 hash: | d7dd8868b5318b516d22930a624d096d |
| humanhash: | social-zebra-video-hawaii |
| File name: | New order and image.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 333'824 bytes |
| First seen: | 2021-09-30 10:44:15 UTC |
| Last seen: | 2021-09-30 12:04:22 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5836b0745b42c6bdea4bd6e4cf5c6b7d (4 x RaccoonStealer, 4 x ArkeiStealer, 2 x RedLineStealer) |
| ssdeep | 6144:rR9FUUHtoJT4BMsDLIXoCXodIL0XhLD7snAm:rR9FUUWJTgkXoNdnLDgn |
| Threatray | 8'306 similar samples on MalwareBazaar |
| TLSH | T13864BF10B7E0C034E5F312F6497993B4A52DBDB1AB2481CB62D53BEA5A34AE0DD30797 |
| File icon (PE): |  |
| dhash icon | c4f0f0b0f2f88cc4 (1 x Formbook) |
| Reporter |  GovCERT_CH |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New order and image.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-30 10:47:40 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching the default Windows debugger (dwwin.exe)
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj
Score:
92 / 100
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2021-09-30 05:49:01 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 8'296 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:dn7r rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Formbook Payload
Formbook
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://www.yourherogarden.net/dn7r/
Unpacked files
SH256 hash:
37ded35a9642064abf77680a8001ed61ab3e44f02d087aa2c298dad5354c9d09
MD5 hash:
69c5fa95dad7d3f16e220f9a83ab67ab
SHA1 hash:
4891df071dcb5f455770a9b51dcaa56931ba8811
Detections:
win_formbook_g0
win_formbook_auto
Parent samples :
bbedcbe77cff074e73d9265b5cd4dfaba57b573065b1cb36e7944880a54239e9
218a43f5f1a1bb3a7974fe8fd0532829b1b858dec3c8d6bc2a5835a6bb735321
9e13a5c939cf22a9d4b60631d6c397903095561e51a9aaaca44be3666abf75e5
d54e341578828a215bbe78db4f2dc64a5388d4ce3bc7d6488f7bafb8c6b02d1c
59202d95bbcb9a85624ae56b93adeecc94b476a0131fe4670b718439ae4da1c9
c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e
218a43f5f1a1bb3a7974fe8fd0532829b1b858dec3c8d6bc2a5835a6bb735321
9e13a5c939cf22a9d4b60631d6c397903095561e51a9aaaca44be3666abf75e5
d54e341578828a215bbe78db4f2dc64a5388d4ce3bc7d6488f7bafb8c6b02d1c
59202d95bbcb9a85624ae56b93adeecc94b476a0131fe4670b718439ae4da1c9
c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e
SH256 hash:
218a43f5f1a1bb3a7974fe8fd0532829b1b858dec3c8d6bc2a5835a6bb735321
MD5 hash:
d7dd8868b5318b516d22930a624d096d
SHA1 hash:
4a01fcbced1e4234bfd10ea8980b6c65684f3b28
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Formbook |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Formbook in memory |
| Reference: | internal research |
| Rule name: | win_formbook_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.formbook. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Dropped by
formbook
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.