MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 968f95cfbc459cd85e555318066b62ad2c11d58474ea8d97f95f3395ed3f2809. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
FormBook
Vendor detections: 4
| SHA256 hash: | 968f95cfbc459cd85e555318066b62ad2c11d58474ea8d97f95f3395ed3f2809 |
|---|---|
| SHA3-384 hash: | c3ac5118ad2adf87377add98e8aac4e85f1d34a5117c699a2a004a7ca1f934a38f86b56aed170a863aa958b56cfdd5fb |
| SHA1 hash: | 44ab40b429b459361cfc178fd01b5aa79db3e296 |
| MD5 hash: | 342e39e307a9cc5d50f83391e6d0bd20 |
| humanhash: | zebra-twelve-uranus-whiskey |
| File name: | Order.exe |
| Download: | download sample |
| Signature | FormBook |
| File size: | 343'040 bytes |
| First seen: | 2020-05-27 07:53:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5fd94ccd1dec1c5baf6be7519f2d9282 (8 x Formbook) |
| ssdeep | 6144:EkJSjYIvo/3HIdaHawBzDvBWEqo4JNXDzdkD:3JYtRWBzDhqo8zzdkD |
| Threatray | 5'309 similar samples on MalwareBazaar |
| TLSH | 5A74AE22F998053DE93F64B0BDC39D568ED609A3506F8C97DA58E102D87CBD0C8A7376 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing FormBook:HELO: db9452k-1.ixlhosting.nl
Sending IP: 5.61.253.39
From: Mhd. Faisal Alnus<visaion@unitbv.ro>
Reply-To: francismark@europe.com
Subject: AW:AW:AW:AW:INV.
Attachment: Order.exe
Intelligence
File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Kryptik
Status:
Malicious
First seen:
2020-05-27 09:08:02 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
22 of 30 (73.33%)
Threat level:
2/5
Verdict:
malicious
Label(s):
emotet
trickbot
Similar samples:
+ 5'299 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.mansiobok.info/mm20/
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.