MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d77c2490675a0f4e86f55ac8751a9a1912cd56bd168d9ae6c110cc385a65872. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d77c2490675a0f4e86f55ac8751a9a1912cd56bd168d9ae6c110cc385a65872
SHA3-384 hash: 0c66c61e0ec59a87869f9636ccd2f2c104055625dc22d256445cb7bcd6128725c3c9ff81b4c7ab4c83a5d01bc3e49c55
SHA1 hash: 1674ffa480ac4cef67d357c94e51ec01555d50a3
MD5 hash: e85b80813c94c6090f2bbac8a12ea27f
humanhash: undress-nuts-sodium-robin
File name:MV DIAMOND QUEEN- V030A_pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:679'936 bytes
First seen:2020-06-29 06:21:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 59d2b94343b1beea04e5ae887d58dc9f (11 x Loki, 7 x AgentTesla, 3 x FormBook)
ssdeep 12288:OPOuvPFClYKfrf9fN30Wvza5TLPw862WecONSyVFBV:OGIPQYKT9lcxLJWISqt
Threatray 5'147 similar samples on MalwareBazaar
TLSH 9CE4AF22E2E147F3D1662B3DBD1B527C982ABE1D7D28584657E49C4CAF3C7D1342A283
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15379/
Detection(s):
Win.Malware.Fareit-6863179-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3d77c2490675a0f4e86f55ac8751a9a1912cd56bd168d9ae6c110cc385a65872/
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 06:23:08 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hv34esigowqpj2dpkwwiounjugiszvll2funtltmcegmhbnglbza._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
035c2fa5d912202dd34e8410b14a42b0db007c2be8ed819bbc444f9818497f5b
FormBook
0e661b488a5571afb39ddf31bda089f7c032ed0a077501c3b7c8a31a0a6442d6
FormBook
344d949f94b4420c0cd7772fa786e17059d5599df223a93ef999ea2c663ad8be
FormBook
487d192d19c37c9d4841141d3a41248b70400caa0cdcaed3d94ac7d4f3782222
FormBook
68b0e57c728398876c4a835e93ff8e5fe6e90d05175a8815ac17b8a4ba4c68cc
FormBook
7378560e6a7dd993634e25ba4c6f301172c742d82c7ae0fd8c71c986fe4af5ba
FormBook
76539c09f989d3cc938d6984f9ee8b6680fe2416822d63bf53a1712aaf9b695f
FormBook
aaf7a834529623fa776d9574d7026a9a40148fec3b8d598e8e8dfced91973760
FormBook
c8b1244a4aa61a5efc1d6ced3ae0407111574eda81cbe9f01f269e5fae9bf4b5
FormBook
fd77bda3f991235956974723013237b8dd8ed7f661dfad976d2fde68804c55a7
FormBook
+ 5'137 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
trojan spyware stealer family:formbook persistence evasion
Link:
https://tria.ge/reports/200629-lfbmy7639a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Checks whether UAC is enabled
Reads user/profile data of web browsers
Deletes itself
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15379/

Comments