MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2b62f1799021ec3671db2883f808f73b3ba1970abb8c76eff529f2b32250c333. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 4
| SHA256 hash: | 2b62f1799021ec3671db2883f808f73b3ba1970abb8c76eff529f2b32250c333 |
|---|---|
| SHA3-384 hash: | a1f9cf8ceed1cfa30439981c706c964f977e80043419b44fa6e6a07d484f552c1508c7de1e57615e25fc8e22f6c4a213 |
| SHA1 hash: | 6c2a832c4ae1a3b4951aacf96f64f6c55ee23274 |
| MD5 hash: | 655df684fc05572dad326fe54004624c |
| humanhash: | oxygen-eleven-oven-carbon |
| File name: | YFAI Tender drafts.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 343'040 bytes |
| First seen: | 2020-05-27 06:57:22 UTC |
| Last seen: | 2020-05-27 08:16:43 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5fd94ccd1dec1c5baf6be7519f2d9282 (8 x Formbook) |
| ssdeep | 6144:EkJSjYIgB7T//bbyJS4UZtidDzTF9aS4NAtC/jIPNFE7Dkvv7PmXDzdkD:3JYtgB7r/bbSGMdBsS4n2FvvvzmzzdkD |
| Threatray | 5'113 similar samples on MalwareBazaar |
| TLSH | E274BF36B928423CDA3F91747DC38EAA8EDA59D3902F4C96DA4CD540CA2D7C50C972B7 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing Formbook:From: "Marc Weinmann" <marc.weinmann@vem-ltd.com>
Subject: RE: project from YFAI m
Attachment: YFAI Tender drafts.gz (contains "YFAI Tender drafts.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Formbook
Status:
Malicious
First seen:
2020-05-27 01:25:29 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
27 of 31 (87.10%)
Threat level:
5/5
Verdict:
malicious
Label(s):
emotet
trickbot
Similar samples:
+ 5'103 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Deletes itself
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.domaky.com/a0u/
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.