MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e5dc622108b69d77e09abf99287d670c8f0249e59971ee49ef7506adb572ecf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e5dc622108b69d77e09abf99287d670c8f0249e59971ee49ef7506adb572ecf
SHA3-384 hash: dfd80a3e20663655c4fda456979dc11289a1f6113c8e731cd4b246b69efa1312ef5b4b49636cc4621805087d94f0e2e7
SHA1 hash: 66ae4a08ea9d0e38642d74a1b7867d507ced9bab
MD5 hash: 21cae8cb761592f1156daa6c87cd3978
humanhash: seven-music-queen-emma
File name:Purchase Order Drawing.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:562'688 bytes
First seen:2020-10-15 11:33:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:8TbHDdiSG0ahtIQK7fuqHeYu6RSJjNJP6jR22f6mL4:8TrDxahtzhKeYu6R6C/h
Threatray 2'697 similar samples on MalwareBazaar
TLSH DCC4BE727992DCBFCD6A07720429C8C5B67616DA3BA0870D319F5B1CCE12B2B635364B
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: reed0.ukrecoalliance.com
Sending IP: 37.46.150.194
From: Mariano Harry <grimaluk@ukr.net>
Subject: PO85922107
Attachment: Purchase Order Drawing.gz (contains "Purchase Order Drawing.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71297/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/492234
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5e5dc622108b69d77e09abf99287d670c8f0249e59971ee49ef7506adb572ecf/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 04:21:31 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lzo4miqqrnu5o7qjvp4zfb6wodepaje6lglr5ze665igvw2xf3hq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0982a348bad7e99222ac6ec6c6dc2c113eb8adff8785bd1f371c5bc90b0025b3
Formbook
0f97d2c99964370b019145742e1d9322e9248fea3e149f00c10ca99807bcafa4
Formbook
2f074d479236e1b4b36733f1e071d6c053a135025cbc62ccc233776b23604390
Formbook
4e712f5df51bc5970b962b170cfde7a6cd20622ac67164a6f2101655a8a7d7f3
Formbook
6d793847fa7272019425c00c17e6f84f719a74a926219a6f6a9c7d96f033fc48
Formbook
718d659864d771ebadf82d8b5461d39c2bd6bd514ea2d2273d2821a23ab28ed0
Formbook
73c740cf8efc312c3fed42aceee4f4513b8ce620aaf31793676f8de2810fdadb
Formbook
a6fd278a82dad870444a8d93e3c05accdfaef779460c2f3777d9ef2441620a41
Formbook
d3096fc849c6c61f96bd31d7cdd062720e18e50a8ad5cabc23c7156c0ecef316
Formbook
dbdd8dc5bf8c5f81b9cbead4224bade6cd697f6f00cbab59bf084f6e39578a8d
Formbook
+ 2'687 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201015-v3a2z7de1e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Formbook Payload
ServiceHost packer
Formbook
Unpacked files
SH256 hash:
30140c3bf5874d7d184b15513016f9de1524ae95a5efe9a1cb15bad6d6936d64
MD5 hash:
03847d82611bc6461cbb99ca768828f1
SHA1 hash:
39859a3fd3326520dfd1ed10456bb227933a8871
Link:
https://www.unpac.me/results/488ad9d3-3540-4ad6-ba00-2bbb23a70490/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/488ad9d3-3540-4ad6-ba00-2bbb23a70490/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
SH256 hash:
cc68e3eb8bccc4a249ec5b6f7d83cb2230442040a398aa362c30bfa520987bc5
MD5 hash:
0c74f2c28837f15bd9481236e4fff068
SHA1 hash:
d6aaa270e7cde6512b8861d725556433b7da78b9
Link:
https://www.unpac.me/results/488ad9d3-3540-4ad6-ba00-2bbb23a70490/
SH256 hash:
c47a570daa466d72505578c12937af3c3209fc754ac8d3dd0b72a831b5b9da22
MD5 hash:
661f1534fd5d41233317dc52f4d7bf56
SHA1 hash:
0342a8bde332961a2455a370c81c5e76ab91cfa3
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/488ad9d3-3540-4ad6-ba00-2bbb23a70490/
Parent samples :
5e5dc622108b69d77e09abf99287d670c8f0249e59971ee49ef7506adb572ecf
b35bd4c70b7e7b6ef3a3a0b1196720b542e78137476b52380b352af1633432b2
SH256 hash:
5e5dc622108b69d77e09abf99287d670c8f0249e59971ee49ef7506adb572ecf
MD5 hash:
21cae8cb761592f1156daa6c87cd3978
SHA1 hash:
66ae4a08ea9d0e38642d74a1b7867d507ced9bab
Link:
https://www.unpac.me/results/488ad9d3-3540-4ad6-ba00-2bbb23a70490/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e5dc622108b69d77e09abf99287d670c8f0249e59971ee49ef7506adb572ecf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz bab7ba2b274542589836c67768543ff4507eceea55df7a57d27051e2378db717

Formbook

Executable exe 5e5dc622108b69d77e09abf99287d670c8f0249e59971ee49ef7506adb572ecf

(this sample)

  
Dropped by
MD5 0b2ce7207f0781e3dd6b8098d09a71fa
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71297/
  
Dropped by
SHA256 bab7ba2b274542589836c67768543ff4507eceea55df7a57d27051e2378db717

Comments