MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64379371f079edd1bb0d1a26a98e0a487c4e89a468f60674d803f929d24d3ecb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64379371f079edd1bb0d1a26a98e0a487c4e89a468f60674d803f929d24d3ecb
SHA3-384 hash: 0b90b120067a53cf1d89e0a0e3713ed335acb1f31916f5f3476e86c745ae21511101b9902af1e5bf6b1cb8e4b7cd85a3
SHA1 hash: d44fce4891c9cbf331c2fe6d9d579f23b10f4089
MD5 hash: 89d09a60f52f57c3ce453088e2e55929
humanhash: alpha-violet-whiskey-idaho
File name:H2pjyhEAKkZfHdt.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:398'848 bytes
First seen:2020-06-10 07:38:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:ndA8i1XBYEen/dgoMU/sNdqMBdtXXhhsm/DZu8JF+smVWTBeM51WFC5:u8eWgTQsTqC/RhsCDZ5+srBeM51WFC5
Threatray 12'530 similar samples on MalwareBazaar
TLSH 3A849D993650B69FC467CDB789A82C24AB60B4775327D247A40712EDAE0D7CBCF106E3
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: smtp76.iad3a.emailsrvr.com
Sending IP: 173.203.187.76
From: ase.dinajpur-b@olympicbd.com <ase.dinajpur-b@olympicbd.com>
Subject: REQUEST FOR QUOTATION
Attachment: PO.9758752img.rar (contains "H2pjyhEAKkZfHdt.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:40:06 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mq3zg4pqphw5doynditktdqkjb6e5cnend3am5gyap4stusnh3fq._file
Verdict:
malicious
Similar samples:
2151298323c73bf6173dc2887e1f50d78d493d3029f3da3b525e48f3aeea5e47
Formbook
6f4b543bdd425e2cb35fcc06f79dfac486985ae0d84133c34e0fd01b3a2c22bb
Formbook
8606768cb758ba8379659f65220250ebc1c491dabd668e7f98663571419cadf2
Formbook
8c57c150d120c496a04aaad020b5458e8eff5f3fd69704a581360c785288c8d0
Formbook
9b727d12d8d7a5568f0e1e4aa4d5e50365e7de1a213f672c68db74aae0f68246
Formbook
a0c33533f61ee5c6065bf97a8e821512778417f2d51b205637af5324a68aa162
Formbook
b189f4b81e32c2be2c252d6f6ba160bf8566aa74be9642af4af5e3b424be54ca
Formbook
b43bca6dcc03b6c289b15fd6dde4bde2dee13d024f08b0ca47efefc9d9aa3d8c
Formbook
bb7d7db00c98fc9b833c3da4a614e726380c6d0a8d5fe45e12ec4209ddf85806
Formbook
ce6d1fc239eb571fde9427c0d7f11d7b6a7a1c0466711524b690ca0de3556a6b
Formbook
+ 12'520 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook evasion persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-z86e7pj26j/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Adds policy Run key to start application
Formbook Payload
Looks for VirtualBox Guest Additions in registry
Formbook
Malware Config
C2 Extraction:
http://www.spatren.com/duj/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a3aa28d96664fc95cf9b74941b6c0015e5c3d18dd5efcee33e1dd1773aa3316d

Formbook

Executable exe 64379371f079edd1bb0d1a26a98e0a487c4e89a468f60674d803f929d24d3ecb

(this sample)

  
Dropped by
MD5 c6954abe475309997c919af83a0cf3eb
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 a3aa28d96664fc95cf9b74941b6c0015e5c3d18dd5efcee33e1dd1773aa3316d

Comments