MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 95deccdc9ef87962793e87e162d62c1d07c56dbae3b964d93e79c190f38183f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 10
| SHA256 hash: | 95deccdc9ef87962793e87e162d62c1d07c56dbae3b964d93e79c190f38183f7 |
|---|---|
| SHA3-384 hash: | 391861e13c232e49dd9e964499cbf6d447b159c432bee00f3cc47876668f5ed48b436771448100b2b9cbd6a871937494 |
| SHA1 hash: | b9358c149083df8f9dd2bc1378eb83806f548ab8 |
| MD5 hash: | 68dd5dd82f770a8c4c0b81c6d79abe14 |
| humanhash: | chicken-one-west-bacon |
| File name: | Payment - Swift Copy.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 761'344 bytes |
| First seen: | 2020-11-25 14:13:19 UTC |
| Last seen: | 2020-11-25 15:56:59 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:FNKxFz/mM3+XAT5zPvEeduShLA68UWt3hIJyN4PJU0xnAPc:wFz/E85LvE2uShLAVUWtRIJXJnAk |
| Threatray | 3'093 similar samples on MalwareBazaar |
| TLSH | A4F47C2B335C87D8D76C3BF5A43001BF31A5DE11426DF6ACCEEAEC8B9B615A81075681 |
| Reporter |  James_inthe_box |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Gathering data
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
formbook
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Status:
Malicious
First seen:
2020-11-25 09:11:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
24 of 28 (85.71%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 3'083 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.danneroll.com/mnc/
Unpacked files
SH256 hash:
a3a008b87ded765ed76c9bedd06dbae5f62edd573da15d376cb3fb91b4bd7f09
MD5 hash:
5ae25f51e2881f74cc9e057ef48c02a6
SHA1 hash:
a8e9e48e0e788e76ce01e923946bfb0c2098b39c
SH256 hash:
7d3db1b5de13ab0b20190e1c4c51f993d303dba35d9ecc1fd2a743642bd247ec
MD5 hash:
a4670b37beea370a4197f0589b45d684
SHA1 hash:
f7761c77e2f3b5550c5db3df1eebd2e71b4b42bd
SH256 hash:
b1e4e30bc93640afc07c9106a0fc72c0b9ec1160aea2d9613d8b2b4456e08e17
MD5 hash:
1bcfc872a36ebee5f129d16001ba6e97
SHA1 hash:
fba5ece123cebd4c77fbe15fc8dda23c3ce0dfcc
SH256 hash:
76239076207b78fdfd629be2b5c418022172793776675c882f5190db54466d5f
MD5 hash:
2e1683c0bf7883418c50740fd8146390
SHA1 hash:
9ef2be61c4b795dd1bbc1377b68068e347295640
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
95deccdc9ef87962793e87e162d62c1d07c56dbae3b964d93e79c190f38183f7
MD5 hash:
68dd5dd82f770a8c4c0b81c6d79abe14
SHA1 hash:
b9358c149083df8f9dd2bc1378eb83806f548ab8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.