MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ee14be97acb9a642ba750f83102361ffa086aeeb3b802531259332fa14e5484. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	8ee14be97acb9a642ba750f83102361ffa086aeeb3b802531259332fa14e5484
SHA3-384 hash:	f7b1de819f5249542cd0fee3929033ed21073f22ac38e8fe8525ab2e2f1dda2953ff160d22dbe777ac8e505f2efd4b2c
SHA1 hash:	eeb65de7ea9164e2ec809b79fe55a8ea0c72d220
MD5 hash:	1d7eccb33fa676ec1a895f9afff89a39
humanhash:	mango-emma-connecticut-item
File name:	1d7eccb33fa676ec1a895f9afff89a39.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	311'461 bytes
First seen:	2022-03-18 11:43:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep	6144:rGiZbfYRlADrjaKhI56ZxmOyPxnyLn9VqVu7xkHlUBA/eHu7Ti:5YRaba7Pxnk3qVEkeBAAuni
Threatray	14'211 similar samples on MalwareBazaar
TLSH	T1EB642207B1E8C977DA535C3789F3A7F2D7B798C28A8551031B804F6E1E5098E2B2C791
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	abuse_ch
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

226

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/252570/

Detection(s):

Win.Dropper.Nanocore-9942113-0

Win.Trojan.Formbook-9942322-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %temp% directory

Creating a process from a recently created file

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control.exe overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/62347064b94fb38cb4a2a15b/reports/e8515279-ab5d-4d0a-bedf-2cc8b1ab85fa/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8078cb6a-5bc7-411c-b675-582c905a88f4

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/959454

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/8ee14be97acb9a642ba750f83102361ffa086aeeb3b802531259332fa14e5484/

Threat name:

Win32.Trojan.FormBook

Status:

Malicious

First seen:

2022-03-16 14:33:32 UTC

AV detection:

22 of 27 (81.48%)

Threat level:

5/5

Verdict:

malicious

Label(s):

formbook

Formbook

3c0036c86eda77a41369d7727d4825c280a8a32641e66bdb4b67e80d95ced9f0

Formbook

4d11816de1a6429b0fa2f9754f7e51e45a6afb350ddd5b806974b629e8fc6fc3

Formbook

6bd24ce0a16599d97686146c6a822023f0f4896fcee914eed9a4e45a7e46b864

Formbook

8392408d685d10ddf024a7e4f47976e03a00fd787bd4ee0932766c4b9b278bc0

Formbook

8e7173102d77a6ed527fc3e783be4aa446e757f4417d3fa1f60f3e9cd0cff4f9

Formbook

99dfa5a36a438daadbbfd9c087e5a005287e5a2b25668ba57a7e78d34b1c3b0b

Formbook

c652919676cc6f3ea808c6e1023de343d27ed8f72f4f1b94523c4ecfb09bf223

Formbook

d1456e0362c877e86044b3c74f22734d2e0ea98233f51a04f683b8f86cb9b4fd

Formbook

+ 14'201 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:r75h rat spyware stealer suricata trojan

Link:

https://tria.ge/reports/220318-nv7m6shgfk/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Loads dropped DLL

Executes dropped EXE

Formbook Payload

Formbook

suricata: ET MALWARE FormBook CnC Checkin (GET)

Unpacked files

SH256 hash:

8ee14be97acb9a642ba750f83102361ffa086aeeb3b802531259332fa14e5484

MD5 hash:

1d7eccb33fa676ec1a895f9afff89a39

SHA1 hash:

eeb65de7ea9164e2ec809b79fe55a8ea0c72d220

Link:

https://www.unpac.me/results/5d0e01a3-8919-40ab-abb1-ea6df6ef5615/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/8ee14be97acb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8ee14be97acb9a642ba750f83102361ffa086aeeb3b802531259332fa14e5484

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	malware_Formbook_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research