MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41c64c9b43a691e8c56957c426627c2b752e4d8294c060c71148c144510ade20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41c64c9b43a691e8c56957c426627c2b752e4d8294c060c71148c144510ade20
SHA3-384 hash: 97a75d17790684a5f54f989ec5ca982257bc8800eba34f079a59b2fe045e5fad698a5aeb2a84f3577c93d77341d0f93d
SHA1 hash: fc46719b21717276f986b3d1ab1c22b00af5850c
MD5 hash: d71c3b30854a3f2947d7512c014c7401
humanhash: social-connecticut-island-lima
File name:RFQ 2021-09.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:8'704 bytes
First seen:2021-09-07 12:16:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5aac9416dafd435c25e06c0aaa4273a3 (3 x Formbook)
ssdeep 192:CH0JH08lYH0yH08lg07H08lYBWF9I59E0:CCvYNvXvJKE0
Threatray 756 similar samples on MalwareBazaar
TLSH T17002C54BB84607D7DAC90EB85D67434B223E179A01AC67720BE73CF9DDBC2239305A11
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ 2021-09.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-07 12:18:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4fbd67a6-7bde-46b5-bad6-11083488dadd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/186021/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader42.36852.19869.13632.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1637dc47-7991-4cca-9fd2-2bc7ce29b6aa
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/846585
Signature
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41c64c9b43a691e8c56957c426627c2b752e4d8294c060c71148c144510ade20/
Threat name:
Win32.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2021-09-07 12:17:04 UTC
AV detection:
20 of 45 (44.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihdezg2du2i6rrljk7ccmyt4fn2s4tmcstagbryrjdauiuik3yqa._file
Verdict:
malicious
Similar samples:
0913bfa77bc5c9494eb3908544f69e4e1d8c9aeeaa26e35efe28e9fe43481a6b
Formbook
0d768a8bfc7ee3f210c89298b44cb8a2567b5c09b6621cb88b7cdecaf04b6080
Formbook
1cc1946825bf1c1c707ba6f27dea1ff8c212fc9192e8b794a7cf9da39ad00c36
Formbook
3c580f5beca53b6599e5f04d3aa68a34bd50521d7ec5d7163849eb69f53a4150
Formbook
3e22ce49e987a1d097778730877bd196bca1182772dbce70d75e109e1ed64702
Formbook
4cb419b34caf346c3682e22c4981686033e6fc816f376deb89ac698771f55843
Formbook
8744b1bba11ed42a3e422599468f9d7aa117bf7264875591a82ebbf1dc4dbffa
Formbook
8fa36ce72b9ecd6dcbcfc55e44bcef14c1bd23c189c2929ac8a2474bd1d0cff1
Formbook
b84c172a230631c06d71bc1c55c8b3aa411adcac5e30a23097de8f70bdcbe978
Formbook
dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec
Formbook
+ 746 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210907-pf13hscec9/
Unpacked files
SH256 hash:
41c64c9b43a691e8c56957c426627c2b752e4d8294c060c71148c144510ade20
MD5 hash:
d71c3b30854a3f2947d7512c014c7401
SHA1 hash:
fc46719b21717276f986b3d1ab1c22b00af5850c
Link:
https://www.unpac.me/results/1e7616a2-9388-4202-840f-ac094391e7b8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41c64c9b43a691e8c56957c426627c2b752e4d8294c060c71148c144510ade20

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819
Rule name:Embedded_PE
Create hunting rule
Rule name:Embedded_PE
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 41c64c9b43a691e8c56957c426627c2b752e4d8294c060c71148c144510ade20

(this sample)

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/186021/

Comments