MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2218130c9581e160a609db084ef0ee73524a9742459742f0b38e25c0374d5a95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2218130c9581e160a609db084ef0ee73524a9742459742f0b38e25c0374d5a95
SHA3-384 hash: b169ca2545e2adc92373d4a6605445682b6536e875a3b355c1f0aefd7180fcc7775692906d774e2867e2aabe0ced3a93
SHA1 hash: b5cdce07b6b03dc6966887d6f6431ce99d9bc718
MD5 hash: 28abad5ccdbb803d75dcb36f2a5b41b5
humanhash: pizza-hotel-pasta-july
File name:28abad5ccdbb803d75dcb36f2a5b41b5
Download: download sample
Signature Formbook
Create hunting rule
File size:181'248 bytes
First seen:2022-07-20 04:56:46 UTC
Last seen:2022-07-23 03:21:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:0Jkxphu44+zZpbGyf2IhWkpXtT50GT63vywad1FYg8muxTwneAkxl+WN7wxZoIqK:Vhuav3+I9dtTyB/uLFYrmDeA+l+WN7wQ
Threatray 17'657 similar samples on MalwareBazaar
TLSH T15204AE36E641C070E3A242F5B27C1B7B843E2D343254A0A6E7E21AD56EE05E5F86D71F
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
4
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/292538/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
formbook overlay packed
Link:
https://www.filescan.io/uploads/62d78b2d8fbcdde3605f149a/reports/20df4db6-21f6-4171-8827-a169be8f9c57/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c93c9b98-85d3-456e-b07a-a88591e87b0e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1037933
Behaviour
Behavior Graph:
n/a
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2218130c9581e160a609db084ef0ee73524a9742459742f0b38e25c0374d5a95/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-07-20 02:38:11 UTC
File Type:
PE (Exe)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eimbgdevqhqwbjqj3mee54hoonjevf2ciwluf4ftrys4an2nlkkq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
09a7e10a1a6d589f868ad25906c6fe212c9d1bd68772f59f55fbb0b528e8ec8a
Formbook
151572bec6e274bad481a8c0736a4888931c086f3fdf890be9811eae7c0c0c36
Formbook
186560894e5762221b8dd00482eff24ea616619628235d1e1a0967eb307c3893
Formbook
400cf8fe4f1f1d748f7e6696227fe25164aa51e2c731e5cc621d708d0015065b
Formbook
4a03cbfeb260c4c92a31e3c5e9d2ef539122ee9b7dc087a9d4db6073959de557
Formbook
66e3770ae0f3de11bc61af85be5c8c78549a4b59f4c3681886e19e1304295af0
Formbook
68461f9c1180025d2b1a97b218ccfd33623fadf5447cfe832f78c9cb816ca0c1
Formbook
c010dafeb95f833b58f5a79bad37776f4dcf5a0806c1df6a17c171a606dd47a0
Formbook
c3b9bd6a3c03e763f6255c275cbb3a068de6feef7417d18b7a3e92c6b28753e5
Formbook
efc51781bc3e82733e68f330ce4905d57bd3188a3584faa693a18223f17ec7ff
Formbook
+ 17'647 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220720-fk92jscad3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
2218130c9581e160a609db084ef0ee73524a9742459742f0b38e25c0374d5a95
MD5 hash:
28abad5ccdbb803d75dcb36f2a5b41b5
SHA1 hash:
b5cdce07b6b03dc6966887d6f6431ce99d9bc718
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/98ca59a4-6ebc-41cb-aef2-ba55e1e0e7b0/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2218130c9581/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2218130c9581e160a609db084ef0ee73524a9742459742f0b38e25c0374d5a95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_Formbook_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 2218130c9581e160a609db084ef0ee73524a9742459742f0b38e25c0374d5a95

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2259182/
Cape
Cape
https://www.capesandbox.com/analysis/292538/

Comments


Avatar
zbet commented on 2022-07-20 04:56:51 UTC

url : hxxp://193.233.179.125/aTTSP.exe