MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 862ca07718035a806f80bb71e2e7de8dbb042803ed854aa332b98adcc7cb8a5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 862ca07718035a806f80bb71e2e7de8dbb042803ed854aa332b98adcc7cb8a5d
SHA3-384 hash: ae203f1f841480d7496c167b4b8f007e2871a7264c55a5bb41871066420641b28714d365a28189c201d8c52454a7ae4a
SHA1 hash: 721c549060b5550394f0a70a6a27ebfcf718d121
MD5 hash: 1565b8a0f021d4c5a91045660f65f432
humanhash: romeo-kitten-beryllium-apart
File name:SES20052020.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:415'232 bytes
First seen:2020-05-20 06:01:53 UTC
Last seen:2020-05-20 06:40:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:BqG2iNF2iNTfptrK9VSJcS7sygO2C51/l:X1j1dfYVSJ8+
Threatray 45 similar samples on MalwareBazaar
TLSH AB94E002B959C57BCABF03B2817245A407349E84EE11E7C75CA83D9D3EF23A065527AB
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheFihaA.30287.26515.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 07:11:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qywka5yyannia34axny6fz66rw5qikad5wcuvizsxgfnzr6lrjoq._file
Verdict:
unknown
Similar samples:
166e8f703c8742e8cc452bc1bd0bab6381eb636bbac96b98a610120616e36d4f
FormBook
2b215f12b5c2f2551558585ee9383431d50812c0b62f97c8c5f6b55a849dfdbd
FormBook
302861906823488445aa55798c426bc5dbabbba3c3f3451f0315fb2b65ee67f5
FormBook
3b9249c30657d9a00ff3bba9aa8f65e5985cfe00d76a10759a3578d29f58a93b
FormBook
3c1ce75269219a15d338a103c5e5baf8629438d062474a7c11e3792fdcabdf06
FormBook
52f137c22685d15df043daabdb9c823e07ecec4df42bcc2fa2c5bd45913d32ea
FormBook
67022527f9317a1cb08a18726bd2414d81b6abf177e56b19326e702a776a34dc
FormBook
7bb95adca7fb0ae8461549f2edb54df110c16a94113f1d1db725ce14672da18c
FormBook
7e6e816dbbc22c332a1abb111dd3ffee00bf301aba6af9343b4caf78be3d9a35
FormBook
7fb38c253c297bdd3fc18c3c3d98e7c3010c15e868eeb395a740f49d6181d20d
FormBook
+ 35 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-s2887qnptn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.glamotd.com/lyb/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 74d38284fdbab1055e523230c628d163500864836becd5561c5812b5e4adac06

FormBook

Executable exe 862ca07718035a806f80bb71e2e7de8dbb042803ed854aa332b98adcc7cb8a5d

(this sample)

  
Dropped by
MD5 ee5e74875a3831be5c201356c77e0fde
  
Dropped by
SHA256 74d38284fdbab1055e523230c628d163500864836becd5561c5812b5e4adac06
  
Dropped by
FormBook
  
Delivery method
Distributed via e-mail attachment

Comments