MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9465c69c18144431c36b77e4b36534684c7717f1d9970eb522b8aef716dd2458. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9465c69c18144431c36b77e4b36534684c7717f1d9970eb522b8aef716dd2458
SHA3-384 hash: 7ad2071c6010a2ecd23d13664792e7be52faf3123fc7464634cf429f5ca1cbb6769089a0e16767c84b70096c42e10a8a
SHA1 hash: c05aae1fb098b338bfce1cf37e4a56c3a87e1aab
MD5 hash: c8fa50c27da79d9f10442b56c4052300
humanhash: spring-pluto-cola-lactose
File name:c8fa50c27da79d9f10442b56c4052300.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'217'024 bytes
First seen:2020-06-03 10:01:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:btb20pkaCqT5TBWgNQ7acv8OzN21sP96A:YVg5tQ7acRzAsV5
Threatray 3'608 similar samples on MalwareBazaar
TLSH 5C45CF1373DE8361C3B25273BA55B741AEBF782506A5F96B2FD8093DF820122521E673
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 04:09:55 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=srs4nhaycrcddq3lo7slgzjunbghof7r3glq5njcxcxpofw5erma._file
Verdict:
malicious
Similar samples:
1edf8c6bcf0ae2b38e9e28bcb1fd838c2ea35b5b126e4bc9e42daa2e1e722298
FormBook
60c5b12508b9f3e9f77cd3a6f8e4b9f3cd546bdc97a76c21b0d758712d9ea4c7
FormBook
6fd98f10610827553549cf795c654fde41891da53df2a254f37a645530b809c1
FormBook
720f6f2a125359d8b85eea767c95d0059cb46eba2fc05a53bcfbf73b5bfc8531
FormBook
72e42f1672249fbd4db20c17d5e29fba5838ef08cf0f6964d84ffc434ea46f27
FormBook
76bf9fbbf199cdbb2c42d49a7d200e2c9b325fdc1c4ad2de205f40331a017243
FormBook
a721e0a8a2daa0d5dee6ff75b846c1dbeb40f697221efb00866e450bea2b391c
FormBook
c9f7661a1a814820db663d5a916abd38a6c824429542e8b833c9a4e67974ac80
FormBook
d3664113994262962936ebe74d0355986970def0cd0bcdcf088fe102047df9ba
FormBook
f43b908ae719e97419ad1ce856a7c4a519a5e01fc318725f693153b41aac3fda
FormBook
+ 3'598 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-ptaskh1cre/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.glamotd.com/zgg/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe 9465c69c18144431c36b77e4b36534684c7717f1d9970eb522b8aef716dd2458

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/375673/
  
Delivery method
Distributed via web download

Comments