MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c274f37d52a6ef7300164ed5c964426b853c7cd3938310a10211439a4b5413ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | c274f37d52a6ef7300164ed5c964426b853c7cd3938310a10211439a4b5413ba |
|---|---|
| SHA3-384 hash: | c9a826b73b50d76bdddbee99e5a8395036ebcac19d724dbc4ee5e3780ec4be17835180a9991a1a7a2011e64082ff1563 |
| SHA1 hash: | 8fcfc099505b7d825f8176af5d2a0dedfd7f39f2 |
| MD5 hash: | bb5ab5b4895da7f1eddbaf67d7fe6067 |
| humanhash: | friend-arkansas-quiet-london |
| File name: | Ziraat Bankasi Swift Mesaji.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 248'844 bytes |
| First seen: | 2022-01-14 11:07:48 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla) |
| ssdeep | 3072:oNyah0mJo5+uoVPvlKLhdo9auOECcQV6a5iI3cHPWexwwqt2DbXfwIFLahXs4VSi:ow1Ivod29iECcQ0IsvWexwdUwZs4kgNr |
| Threatray | 12'684 similar samples on MalwareBazaar |
| TLSH | T1343412BA65E6C0ABE1D24272B633538BD3B3F7013BD4118BD78C2FBA56601871D165D2 |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | exe FormBook geo TUR ZiraatBank |
Intelligence
File Origin
# of uploads :
1
# of downloads :
335
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ziraat Bankasi Swift Mesaji.exe
Verdict:
Malicious activity
Analysis date:
2022-01-14 11:14:03 UTC
Tags:
installer trojan formbook stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
DNS request
Searching for synchronization primitives
Reading critical registry keys
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
control.exe expand.exe overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
formbook
Threat name:
Win32.Trojan.Risis
Status:
Malicious
First seen:
2022-01-14 11:08:11 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
14 of 43 (32.56%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 12'674 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:a0p6 rat spyware stealer suricata trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
364845e0cbf2e75ecb60c53ea9131c2222ba53ab3963920330f717c67247670e
MD5 hash:
d9a8f2238da42467fe85945951d59f33
SHA1 hash:
e84c624c54d793ffa5333c48d020cea658084b7c
Detections:
win_formbook_g0
win_formbook_auto
Parent samples :
c274f37d52a6ef7300164ed5c964426b853c7cd3938310a10211439a4b5413ba
ee3102fee650284b04e3ac5646e83dc54ccaec30e9c484bc8159a1d4d7713299
0e3dc9a9c08c1dadb1cb920c7d32b7f9fee978460a15f8459a4cc12c98c6e7cd
c6cbe14f336bc97cc4bf2db682cc36efc1b371f6cc45509ee347c29348903676
baef60b7ed8a0286e276a7b7d76c7a9d52a8a77c2688b0d2b2cc1d886954b1a0
ee3102fee650284b04e3ac5646e83dc54ccaec30e9c484bc8159a1d4d7713299
0e3dc9a9c08c1dadb1cb920c7d32b7f9fee978460a15f8459a4cc12c98c6e7cd
c6cbe14f336bc97cc4bf2db682cc36efc1b371f6cc45509ee347c29348903676
baef60b7ed8a0286e276a7b7d76c7a9d52a8a77c2688b0d2b2cc1d886954b1a0
SH256 hash:
de9bf1eaff348707d8ed3f4ddf31b696edaaf6a2e1b228785198258ec8cd6706
MD5 hash:
a85b7c70d00f1a15be15108bb6f5601e
SHA1 hash:
e3bd606be8d0c6dbf87bc4f92cac260f5353c507
SH256 hash:
c274f37d52a6ef7300164ed5c964426b853c7cd3938310a10211439a4b5413ba
MD5 hash:
bb5ab5b4895da7f1eddbaf67d7fe6067
SHA1 hash:
8fcfc099505b7d825f8176af5d2a0dedfd7f39f2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.