MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4923037fb58a4491f08c85e0cf38a74d92dd36860932814170dc942a031bad2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4923037fb58a4491f08c85e0cf38a74d92dd36860932814170dc942a031bad2f
SHA3-384 hash: 89c185b4ef99eb4e223c2618d71a21891ae1e2c0323ee9d5616dc0573f8b93b4c606e8efd2092ee9cc9724081c49e282
SHA1 hash: 9b16a4acecc17e8244bbd4a5372abcefea4ac388
MD5 hash: e0ee47bdf12704037e8e591057e93cc1
humanhash: yankee-alpha-alpha-mexico
File name:nass.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:499'200 bytes
First seen:2020-05-06 10:26:03 UTC
Last seen:2020-05-06 12:25:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 6144:560igYFlJJL7XJAnY7ggBuMUGsc6i7VaBa5aEL5Tvzj4:560ixxJHX+nOga0G57gBa0E5
Threatray 5'695 similar samples on MalwareBazaar
TLSH 2BB4AE3367C2C828C57B0171947D5ACF513A1F5236459E6FA39AD3182F9325BF32A22E
Reporter JoulK
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Formbook.30863.32698.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 08:15:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jerqg75vrjcjd4emqxqm6ofhjwjn2nugbezicqlq3skcuay3vuxq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
24a74c858b9e16322e848c84a2e9e915f493da9580b5f4653eb236c836484738
FormBook
3374d3d11eef1e8fc48019fccac4fb5475ce8fec60c5e019c64662723fd5c1b3
FormBook
82052d2d1596128ae63d047a1e239b44961a763bf3ecb0ce831483db2199bb57
FormBook
addd4ba4b4aa754501d638cbbf3c78bec538ca15a72acb5eadc7babfaecfa350
FormBook
b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c
FormBook
ce4ed6743aa45509170cb294b6a2bbddd2018fb51e1626f98bd590f7968be44e
FormBook
d801d7b446d8b77042cce4bdff252df71ba4a346e744253679889d3a0d268726
FormBook
ed3318102d772c4dcecfb1e10f37cfd3fdcbaff1d340ba9c2bc5dcfe6383f339
FormBook
fc714509dc4c3d6f3e13028be7be8207b2377331266c8ce213c575e511f8d31f
FormBook
fd00ad5d0025b9f1104c1422dcb7c00dfc2e004b6aced9e354fa430388656681
FormBook
+ 5'685 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook agilenet persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-wa1rf8k6t2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.mansiobok2.info/mnf3/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe 4923037fb58a4491f08c85e0cf38a74d92dd36860932814170dc942a031bad2f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/358705/
  
Delivery method
Distributed via web download

Comments