MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 375d1a9b98531aaaf0d05ad0c23f5ddca52ec2bbd4d2abeeeab58d03f8d8b630. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	375d1a9b98531aaaf0d05ad0c23f5ddca52ec2bbd4d2abeeeab58d03f8d8b630
SHA3-384 hash:	e6238c6e25995f931b4bc77a536ae600a23d219196a1124c3e7fe192342e870575081e460a5b88d9157cb70d3ed44352
SHA1 hash:	efd61f0fa32705f43b2c0868ad2db5be14b2ae78
MD5 hash:	f57b8f73c29253df1f3626a77c4f1050
humanhash:	mockingbird-summer-pluto-lemon
File name:	f57b8f73c29253df1f3626a77c4f1050.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	189'952 bytes
First seen:	2022-08-29 08:04:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	3072:C6fjkTNelMn+9Q3ewWmcf27fpnzBhg57/OecSJQtrUypyTgUGIY1acE:Lbee3m97fpnNUGehJ2UIX/IiaB
TLSH	T1DD04AE32D641C031E2B312B5F6BD1B7B893E4E343255A1E6A3F116A06FA49E5F12931F
Reporter	abuse_ch
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

254

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

ProductXSpecification.doc

Verdict:

Malicious activity

Analysis date:

2022-08-29 07:20:14 UTC

Tags:

exploit CVE-2017-11882 opendir loader formbook trojan stealer

Link:

https://app.any.run/tasks/6bdbd659-00e5-46a7-8fff-fb154cf978ff

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/302097/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL

Win.Malware.Formbook-7399661-0

Win.Malware.Formbook-9951997-0

Win.Malware.Formbook-9964980-0

Result

Verdict:

Malware

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

formbook overlay packed

Link:

https://www.filescan.io/uploads/630c7388a7450371f6876fb1/reports/8445dc02-b962-40ad-bb9e-bac8a52a4096/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b13eaf1b-38fb-4abb-8a61-f601d18be306

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1059687

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect virtualization through RDTSC time measurements

Uses ipconfig to lookup or modify the Windows network settings

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/375d1a9b98531aaaf0d05ad0c23f5ddca52ec2bbd4d2abeeeab58d03f8d8b630/

Threat name:

Win32.Trojan.FormBook

Status:

Malicious

First seen:

2022-08-29 04:28:00 UTC

File Type:

PE (Exe)

AV detection:

25 of 26 (96.15%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=g5orvg4ykmnkv4gqllimep253sss5qv32tjkx3xkwwgqh6gywyya._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:fs93 rat

Link:

https://tria.ge/reports/220829-jyvqkaeafn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Unpacked files

SH256 hash:

375d1a9b98531aaaf0d05ad0c23f5ddca52ec2bbd4d2abeeeab58d03f8d8b630

MD5 hash:

f57b8f73c29253df1f3626a77c4f1050

SHA1 hash:

efd61f0fa32705f43b2c0868ad2db5be14b2ae78

Detections:

win_formbook_g0

win_formbook_auto

FormBook

Link:

https://www.unpac.me/results/4036cfd6-4291-4a71-ad4e-62ecae4732a1/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/375d1a9b9853/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/375d1a9b98531aaaf0d05ad0c23f5ddca52ec2bbd4d2abeeeab58d03f8d8b630

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	malware_Formbook_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research