MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c956e15151905e1744fc41cdbf55919d03f196900f62991baa919404b6a00bbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c956e15151905e1744fc41cdbf55919d03f196900f62991baa919404b6a00bbc
SHA3-384 hash: 3518cfd982d74d298e9b5964fedf3578e57889ae41d2fe5bb5e6eaba5af515ca70a687b7c705526814e2096a48cdd1ae
SHA1 hash: eba7e7be3747723d784589b3ea1fa6c1713fa20a
MD5 hash: 7b9f49f579eca86c715f438c47f7ca1e
humanhash: oregon-spring-bulldog-artist
File name:Invoice.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:327'680 bytes
First seen:2020-05-26 05:58:32 UTC
Last seen:2020-05-26 06:49:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 025dfd9775e9f374b8320b687fe4b979 (6 x FormBook)
ssdeep 6144:iGl4FLCRqkMBkyIjwaL48Ya2GFgIwcMXDzdkD:irlTVk7jWLJGFgXcMzzdkD
Threatray 5'298 similar samples on MalwareBazaar
TLSH 5B64BE22A9799A3CD63F50F5BDD7CCAA8EC51893A1AF8C96C55CC205C82D7C1C867237
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:49:24 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
netwirerc
Create hunting rule
trickbot
Create hunting rule
Similar samples:
00983a8176276beea115d21fef7919c49b29b96d78dbc2151cc04cc7d8c95b35
FormBook
3e98d7f59e495ddfa5140a50f70347bb4a56296ca2dcb6602f65ebb4e4a0373b
FormBook
474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f
FormBook
4c1fe4c0f5d8d1277036802c83df3e083b31318dfc2c194ce93b7169d7ba6e3d
FormBook
6f827b68129d30609057c2e6b36be05649fce91d6bc8ee3d3566ca5c6aba562b
FormBook
968f95cfbc459cd85e555318066b62ad2c11d58474ea8d97f95f3395ed3f2809
FormBook
9b2c6f08cd9a4e3b144422de4d540290542ce50239f2c85697a036a461b25264
FormBook
dc390cfb0419c5a93c339e395061b5ed5d9d7b08995680552d409c8f8302a109
FormBook
e13acda03eb4829793beb5c0664d5752663b7ef5ae72b63724e7eaf189a9fec4
FormBook
e273d82c782a01c388cc619e6832bfb43301f4308884751b9393262302fc84c0
FormBook
+ 5'288 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan persistence
Link:
https://tria.ge/reports/201109-nwplkjbnm6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of UnmapMainImage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.mansiobok.info/mm20/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip fd5759ca4b1d153ffaab45e90d98e30efb3c9d63fa313debccfce6781c7b7acb

FormBook

Executable exe c956e15151905e1744fc41cdbf55919d03f196900f62991baa919404b6a00bbc

(this sample)

  
Dropped by
MD5 f987634820b662d75a7f5aecf044defc
  
Dropped by
SHA256 fd5759ca4b1d153ffaab45e90d98e30efb3c9d63fa313debccfce6781c7b7acb
  
Delivery method
Distributed via e-mail attachment

Comments