MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45dadb6ef316c7ca2666824bda67f8bd3d9266fc2db706d167f7a3105ed973fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45dadb6ef316c7ca2666824bda67f8bd3d9266fc2db706d167f7a3105ed973fd
SHA3-384 hash: 9aa24cf872478429d25d95c3b607a1f93fe21a6aa8f903e9a1d51fe15bfdd9c17fa2179975a2f214d5ce24a519db4dd7
SHA1 hash: 0457bfd9afd929612588957a9ea449d711ee2446
MD5 hash: f00d136627742dc976d4494c24fd029c
humanhash: seven-kilo-leopard-colorado
File name:SecuriteInfo.com.Trojan.Siggen14.403.27988.15967
Download: download sample
Signature Formbook
Create hunting rule
File size:231'508 bytes
First seen:2021-06-23 03:00:10 UTC
Last seen:2021-06-23 03:42:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:QBlL/ViD2nBqRjpdXHswRns7RnmfNUsjOyRyvzMX:ifi6BAj3Hs8ini7BAvg
Threatray 5'925 similar samples on MalwareBazaar
TLSH 4634122EBAD0C877D58347F4AD72DB88D77A85482861E1CF1331AF6B55311830B8A6CB
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.Siggen14.403.27988.15967
Verdict:
Malicious activity
Analysis date:
2021-06-23 03:01:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6e7f4211-d140-4f5d-b674-49108a81d304

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167710/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.403.27988.15967.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fc46470c-d5e9-44cf-9cb9-2509130b0ced
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/806347
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/45dadb6ef316c7ca2666824bda67f8bd3d9266fc2db706d167f7a3105ed973fd/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 04:33:11 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ixnnw3xtc3d4ujtgqjf5uz7yxu6zezx4fw3qnulh66rraxwzop6q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0881127ba3ada84a8259b0e923fb8723a89016ae555bb59c44a9b372bba7daab
Formbook
1eb6d2eb88d3ebac022b8335e178275dd4b8883b7e5248a8a8c4a1da9faacddc
Formbook
2450d5f5fa69393262ee4d935acf867ff537ffaaa0a927823b748d5d77dd9fcc
Formbook
4d81b8f02e5a9eadfdb53142d1ad0c6793d07ca942f5ff5f946e6854fbe74c26
Formbook
4f9d8536fa4475655dd14db7d472399f2b7214ddb16d3483f9a2a673e4fc1543
Formbook
74743d6468cedf3e66f1171ef32981dca4fb211b3fd7be519045fc42b077ced2
Formbook
932d535ab92b682eff0f74322211abd760021a9003d18b953e7226a6ebc38902
Formbook
c59f3d09668674cc602a759071c5972b8f78b2b829afd3fb8d5e6f9ecd820280
Formbook
e242d70710f47daf819f4dec74264d265efd80a1aa12eec27c0ac20715670923
Formbook
fb6e849cd3af7e8b0c8143397e62a595a42abbfbbac81f2cdd0b2cb4d18ea543
Formbook
+ 5'915 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210623-6wh8vqk512/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.gicc-fx.com/uer0/
Unpacked files
SH256 hash:
d17e5821d4a2e27b69fc5f92233fe7c94cba0f8ad92efcdae7a002f62100275c
MD5 hash:
2a3357f7f8032583bd303b8444b6c50d
SHA1 hash:
facb0b6606fc299c4bc91963dfbb992c27ee7c47
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/23c3f2e9-0bda-4fbb-bfd1-d0bb994d873e/
Parent samples :
fb6e849cd3af7e8b0c8143397e62a595a42abbfbbac81f2cdd0b2cb4d18ea543
74743d6468cedf3e66f1171ef32981dca4fb211b3fd7be519045fc42b077ced2
0881127ba3ada84a8259b0e923fb8723a89016ae555bb59c44a9b372bba7daab
aaa2dcb2a94844c7059c483090f4d28c0efc2993438ddfc22c6d4c0ec93c0562
2450d5f5fa69393262ee4d935acf867ff537ffaaa0a927823b748d5d77dd9fcc
e242d70710f47daf819f4dec74264d265efd80a1aa12eec27c0ac20715670923
45dadb6ef316c7ca2666824bda67f8bd3d9266fc2db706d167f7a3105ed973fd
SH256 hash:
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 hash:
56a321bd011112ec5d8a32b2f6fd3231
SHA1 hash:
df20e3a35a1636de64df5290ae5e4e7572447f78
Link:
https://www.unpac.me/results/23c3f2e9-0bda-4fbb-bfd1-d0bb994d873e/
SH256 hash:
45dadb6ef316c7ca2666824bda67f8bd3d9266fc2db706d167f7a3105ed973fd
MD5 hash:
f00d136627742dc976d4494c24fd029c
SHA1 hash:
0457bfd9afd929612588957a9ea449d711ee2446
Link:
https://www.unpac.me/results/23c3f2e9-0bda-4fbb-bfd1-d0bb994d873e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/45dadb6ef316c7ca2666824bda67f8bd3d9266fc2db706d167f7a3105ed973fd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167710/

Comments