MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b2338d420a3ff8d829f3ba666a8a4af8fad2cba584c5b31a9378adaf2947870. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b2338d420a3ff8d829f3ba666a8a4af8fad2cba584c5b31a9378adaf2947870
SHA3-384 hash: 34cf58aba637d788f8cb71ea3102a70ae2b202b1db3dd17d686145efa05a296d6cdb814ae091f461535fcd4e86a76be1
SHA1 hash: 5818adb24dcdeba3fa1b85a695e765780f1ac95b
MD5 hash: 971627fdfae72e3cbc874b18722d4446
humanhash: angel-finch-skylark-nuts
File name:cc.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:236'032 bytes
First seen:2023-09-26 12:48:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:ALe7b66HcFK/roPethfrD/2JeqBsSLa+AbR/S995fQ/FVAx4kl7CNh3KUevye61:DbsYzFDDmeyI+c09MFV2D7CNMHh6
Threatray 32 similar samples on MalwareBazaar
TLSH T10634239AC32D9A4DC9B2423CE0566D4640659F1CB79207BB6A892D3CDD00B3F73E4747
Reporter Anonymous
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
US US
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
cc.exe
Verdict:
Malicious activity
Analysis date:
2023-09-26 12:50:42 UTC
Tags:
formbook xloader stealer
Link:
https://app.any.run/tasks/59ca9fbd-d7d4-4fe2-93bf-51d87517051f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451274/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Launching the process to change network settings
Unauthorized injection to a system process
Gathering data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6512d33f32ffdb7a7a14e1ee/reports/cf33ba80-71d2-4a2c-92d8-c7abd55d052d/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/3b2338d420a3ff8d829f3ba666a8a4af8fad2cba584c5b31a9378adaf2947870
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/078349d3-1214-47d1-96ff-bff2a0ffb942
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1314521
Signature
Antivirus / Scanner detection for submitted sample
Deletes itself after installation
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b2338d420a3ff8d829f3ba666a8a4af8fad2cba584c5b31a9378adaf2947870/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-09-26 12:49:05 UTC
File Type:
PE (Exe)
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hmrtrvbaup7y3au7hotgnkfev6h22lf2lbgfwmnjg6fnv4uupbya._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01b15d113f147c931149f8d1c883bbad3c3752cba08a96855774d21a3bb6e44a
Formbook
05360352816fd2dfd09c05a57131f86c59fd38f7153c5261973216cf596ad077
Formbook
09b328e48038594af6d79eb256d8fd6de1252725026f511bc1d0fcf7440a21fa
Formbook
32119baabd1fab988ebaf2f5692f46c797902e94b52729c27f30f8e579feb530
Formbook
50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7
Formbook
8326158d0aea2a3ee6a49cc3f88e1c3779eb479790a8b0451133a09c1ca0a777
Formbook
96a3709a8156268f9daaeac2aab9c66146967ef173e5d5d2e8a0ed8bde75ab63
Formbook
9fe145f64a6f2ed8283b9bfb1e97a3c93087d8495a53af984d619760c7d859a5
Formbook
becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789
Formbook
de99e6f0be1e9a5d12fa7d4fe82b34cfb6ba6b85cee18e4acec0d7f97593bcbf
Formbook
+ 22 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230926-p2b1hsaf65/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Unpacked files
SH256 hash:
10ecc099f33de0fce9a7577d0807c606b3ecc3e80b8aa0f922663534bab423e1
MD5 hash:
5caba34b502b6ca90b92676831ffb763
SHA1 hash:
549b2d3401e41001558b75f167379a6387d959a0
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/771beecd-356f-4f2a-a1d7-713e26c8a1ba/
SH256 hash:
d72daed1eb02d7aab6f036566c1490efa2570cf71e033e0393a160ce99d7562a
MD5 hash:
3e08cbaaae8458cb0cc8f8eb57d6aeb9
SHA1 hash:
dfd35649c826678826163405b48bd8c69d746174
Link:
https://www.unpac.me/results/771beecd-356f-4f2a-a1d7-713e26c8a1ba/
SH256 hash:
ea1769329dd603f6198f614b0aa7816f9c99fe01fe5237afc5adc727be69cd81
MD5 hash:
18223042c205be6a8d612300155dc15a
SHA1 hash:
c2087e5b64f46214aa2b7f6e30597c61e4e2f952
Link:
https://www.unpac.me/results/771beecd-356f-4f2a-a1d7-713e26c8a1ba/
SH256 hash:
b23f131f45b5d1995180381fd5e840ece351cb75d7ca26c65dc1fb54d24193ef
MD5 hash:
bfcd8e6d70ec3cad0c692e9915afd8f0
SHA1 hash:
785a4f4b2450f652b6943b2abbcbf173ed761b46
Link:
https://www.unpac.me/results/771beecd-356f-4f2a-a1d7-713e26c8a1ba/
SH256 hash:
c2519fd436c3103640e768be4c6f8086051a45cfea2ccdf55f1bec2c51217791
MD5 hash:
d0b2d11217a4a8d290cca3029af71e63
SHA1 hash:
447ca82756095a3fbf0f16f2c7af9916cb58cf72
Link:
https://www.unpac.me/results/771beecd-356f-4f2a-a1d7-713e26c8a1ba/
SH256 hash:
30be63bee94ad75027f2a6ca001a6ff94a0111b8d640d8f5e756d2fef0e293b1
MD5 hash:
c395489f70b3109cba5aa47eee69b903
SHA1 hash:
3623f01a470228fb1ac5481e9c9b2ce0d1d6ceeb
Link:
https://www.unpac.me/results/771beecd-356f-4f2a-a1d7-713e26c8a1ba/
SH256 hash:
2d7d363f7fa8d0ad52aa747c278871d50171d0af7c561048137298f0277ace9f
MD5 hash:
8d31eae5cba9fe108eefdd687fc3fe34
SHA1 hash:
12f08790c594644630eb382e151e0640d0ec190e
Link:
https://www.unpac.me/results/771beecd-356f-4f2a-a1d7-713e26c8a1ba/
SH256 hash:
3b2338d420a3ff8d829f3ba666a8a4af8fad2cba584c5b31a9378adaf2947870
MD5 hash:
971627fdfae72e3cbc874b18722d4446
SHA1 hash:
5818adb24dcdeba3fa1b85a695e765780f1ac95b
Link:
https://www.unpac.me/results/771beecd-356f-4f2a-a1d7-713e26c8a1ba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b2338d420a3ff8d829f3ba666a8a4af8fad2cba584c5b31a9378adaf2947870

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/451274/

Comments