MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3188ff8a40a461c9e4e386a62daefbe7033034a0c28cfb2b02c20874b7f53b92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3188ff8a40a461c9e4e386a62daefbe7033034a0c28cfb2b02c20874b7f53b92
SHA3-384 hash: 9cc26b58306e3aa0f470247c6526a53bef1e6929d9591a55a730de243474befa0e62f6534e112e642409fe623ec80777
SHA1 hash: 3de8071ccde8d5ca94c2ce7e32cef9797ce8f493
MD5 hash: 445a470dc209db296bf4701a527afd85
humanhash: magnesium-red-echo-grey
File name:MV STARSHIP_pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'395'712 bytes
First seen:2020-05-28 05:08:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Dtb20pkaCqT5TBWgNQ7aNgFgm+nNVQUfOhH18xth6A:AVg5tQ7aNg2dGvK5
Threatray 5'840 similar samples on MalwareBazaar
TLSH BD55D01373DE8365C7B25273BA25B701AEBF782506B1F56B2FD8093DA820162521E773
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 01:02:13 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
0b754578fd025440dc9661b2a4f0c853fa57a9dbb2c33d27ff7802176d38238b
FormBook
29bad4252fa4cda5eea6a5a8587169e1d88d58f9c1fed8c13cf29695995178b6
FormBook
4f51da0a7034a3b491bf21d56896d2cc97f5f240911abfaeacfe73d80bd84a34
FormBook
60c5b12508b9f3e9f77cd3a6f8e4b9f3cd546bdc97a76c21b0d758712d9ea4c7
FormBook
6858f384401b1ef40dd4515a1604fdf9bb7e0d5caf85d8798c89604d830227e6
FormBook
8d1512de63fd1bf66f80c8ec2ec640464a6ce986101849488372a38fed2bcfb6
FormBook
b6b19634b174ec68dacf4a4f936d8ad91e4374737de56f1e3995b51f778f755b
FormBook
d3664113994262962936ebe74d0355986970def0cd0bcdcf088fe102047df9ba
FormBook
ea95c0511e50da3a5225f551733b37b0b8f117b42dacd071620984fb550a00c9
FormBook
f130cec484223c8a539691962d1f9cd065bb45776e25bb34037c64d89be0e9d5
FormBook
+ 5'830 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-jyge5hw6b2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.lodipytu.com/xla/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 9a91d081021367b019ff9ab4a6b45e90f48d8d60fccbcd853224edb020e66074

FormBook

Executable exe 3188ff8a40a461c9e4e386a62daefbe7033034a0c28cfb2b02c20874b7f53b92

(this sample)

  
Dropped by
MD5 ceef868ff28caf323ac63b6846ac2cd5
  
Dropped by
SHA256 9a91d081021367b019ff9ab4a6b45e90f48d8d60fccbcd853224edb020e66074
  
Delivery method
Distributed via e-mail attachment

Comments