MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a63970797fb58518941452743a98384af7c90c90adbf9f18146d721105ec843a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a63970797fb58518941452743a98384af7c90c90adbf9f18146d721105ec843a
SHA3-384 hash: e22df667ce5bf18ab819b317583619c2cc3527e2fdc682c66e31fd361f8ce20b3a2c3a6eb9b9dc4f02a78e9cf1975a2e
SHA1 hash: 8a2c4347ed83c2f636a6eee8731b733245ac76f2
MD5 hash: 7737fb247f74adde48812f0561d4b11c
humanhash: september-lamp-earth-fourteen
File name:9671-2020.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:284'672 bytes
First seen:2020-06-22 05:50:24 UTC
Last seen:2020-06-22 06:41:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash dd5f8b0707ceb863b351d3105c092df6 (8 x Formbook)
ssdeep 6144:FoH9MNLXrve4rJgp4nW1TFYEXTgU1SODpR1emS+CxesUN03jn4kETkXn9xK:2H9wDa8g2ngTFzFDDpRcFIsUqTnWG9xK
Threatray 5'290 similar samples on MalwareBazaar
TLSH 3454E15362D98C74E067E13D9D6AAC268D7F3C2089B604127AD5235FB67068416BF3F3
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/12392/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a63970797fb58518941452743a98384af7c90c90adbf9f18146d721105ec843a/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-21 23:43:59 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uy4xa6l7wwcrrfaukj2dvgbyjl34sdeqvw7z6gaunvzbcbpmqq5a._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
trickbot
Create hunting rule
Similar samples:
03d585ea89f4e62bc18d42d1fadad0b02faca6d68c831e79fb542e9efd183f7a
Formbook
08fd08ac92e87f077dfa77ab5cbe48dccb7ffc87cd338a6451b884d42fa6306b
Formbook
3ed07bacd6fc8880ef3e79d21c4d3c6397f95e027d663aea9af21c074b10f67b
Formbook
51ba9fa1830056b815cc4203b57ee4f46b26a5f7dd7f6a01066c94fb88bf8f01
Formbook
590fde182a154cd89b15d88546d60351b9fecb51e04fbbf4affd8d49a618bd23
Formbook
ab837860c80711ebd28b745c4794d39d6cdf49281404fac8bbbec29f3a5e1e24
Formbook
ae8a8ca63a358e0c9cd1ce5100464f1c1dbd2b7724632fffc5e15152c67dc6fb
Formbook
be62fe48cc7e28c398424847ed5a73946fe0ae70f2af9980ffc68c57c2103550
Formbook
ee4ae13d3fd3b58d86e270db11937476b4b7add1673983c2c28ed4d7dcc75552
Formbook
fad88fa44fea006090c7d5dae844338afcd1b7c0de32b31ee4e074fcb9474f41
Formbook
+ 5'280 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
persistence spyware trojan stealer family:formbook
Link:
https://tria.ge/reports/200624-sk8qnb8zdj/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Deletes itself
Reads user/profile data of web browsers
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 8e9bac19dc8e75ef1fcbf3d5e63b7aee4a33b0efe22408a36b588d07be71bb3b

Formbook

Executable exe a63970797fb58518941452743a98384af7c90c90adbf9f18146d721105ec843a

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 8e9bac19dc8e75ef1fcbf3d5e63b7aee4a33b0efe22408a36b588d07be71bb3b
Cape
Cape
https://www.capesandbox.com/analysis/12392/

Comments