MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b24a5df4c63722afbed1e3807b18fcc065008ec3431de146dbf3657dffa00893. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b24a5df4c63722afbed1e3807b18fcc065008ec3431de146dbf3657dffa00893
SHA3-384 hash: b098ceb94400cc9a8c04ebbf733fb438574013fa2db25968d3f740441caa958927b380a42a62f453811aedbdae5778b6
SHA1 hash: 70c49f94e4de1cc313c665290a745935e4907b02
MD5 hash: 769f251ba0085e1b6fa19c07fe8a6d96
humanhash: crazy-georgia-speaker-white
File name:orderquantity.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:358'912 bytes
First seen:2020-06-02 06:46:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f22635dbd118c4c2567a245ddd95bb69 (9 x FormBook)
ssdeep 6144:m1iKedvilWxzRxPcOLGNLrXlTYwfHbWw:m/enPVLGEwPy
Threatray 5'103 similar samples on MalwareBazaar
TLSH E474E0947681E23DF2AAC27D4C14DC5690A82E534A753EC777C42FCA5937183AE3CB26
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: postal.zeregabertrading.info
Sending IP: 176.107.177.184
From: Mohammad Hijazi <sales@steelpipespe.co.za>
Subject: Purchase Order100502020
Attachment: orderquantity.rar (contains "orderquantity.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 21:34:00 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wjff35ggg4rk7pwr4oahwgh4ybsqbdwdimo6crw36nsx375abcjq._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
trickbot
Create hunting rule
Similar samples:
00983a8176276beea115d21fef7919c49b29b96d78dbc2151cc04cc7d8c95b35
Formbook
0d271903774ae9467d80cad6fcaec4d2ea4653b8eb4c28e0a1c7dbe0849ccd01
Formbook
2a40a9e18303875b2db452783190820001c898e8374864fec29793bf43bbe401
Formbook
2b62f1799021ec3671db2883f808f73b3ba1970abb8c76eff529f2b32250c333
Formbook
569b8cf6219a91161d48291f13285babe58b3be185623f3ec44c65c8369c2278
Formbook
5f09e9c7496cd8bfbb33147b3fea11791894235021e488eb17dcd582c9dae0b1
Formbook
9caec0c38913b9f2b16161ea88489a600de3eb402192b91d09cf8b692719c4cd
Formbook
a6009a6b0724811f3bb71fc6f0c6b3b1aad71448948175949c7eb8af82034e91
Formbook
e825c5b9c196015372cc2153f670cdfec42827fe20aff62c5d493b67fd9c92f1
Formbook
e8edf009c1c82f348ad925f7f9a34b4f241d52240c6cb43ab4536c4b363d5322
Formbook
+ 5'093 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-2a8aecycsa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Gathers network information
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.regulars5.com/ch02/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 25e3c5024b79296131093e8ee80112ed5f5761e52447ec558c1745a2cf61ff9c

Formbook

Executable exe b24a5df4c63722afbed1e3807b18fcc065008ec3431de146dbf3657dffa00893

(this sample)

  
Dropped by
MD5 bf75daf5d10d1472a85ad93c44973884
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 25e3c5024b79296131093e8ee80112ed5f5761e52447ec558c1745a2cf61ff9c

Comments