MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6634157030fbc5aa6d88565981868dcacedfd91b8031ab0e2e8dd1a3f1b1c16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6634157030fbc5aa6d88565981868dcacedfd91b8031ab0e2e8dd1a3f1b1c16
SHA3-384 hash: ccff8904b4ece9217f5c41af9deffa113aede11820eb0b6a25225136c6bf801eab38da2e02cdeb56c07adab28b19f9ce
SHA1 hash: 74b01cf2bdab9a095d36114ce0a2f2c79f173a37
MD5 hash: f5a77ccf5fe98e43753b3652bd1cf581
humanhash: floor-oxygen-eighteen-twenty
File name:FX PAYMENT COPY.scr
Download: download sample
Signature Formbook
Create hunting rule
File size:560'640 bytes
First seen:2020-07-02 12:43:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:voxVMcOk2ZospPt620XZVsDNgI8y9vS6m/JtU9xm8LX:Kek26OrZgX/6mhtU9xm8LX
Threatray 688 similar samples on MalwareBazaar
TLSH 33C405217982D07CD436057084789ED0B7257DE63BF2CF0F628732686EB619B6F2625E
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/18467/
Detection(s):
Win.Malware.Formbook-7399661-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6634157030fbc5aa6d88565981868dcacedfd91b8031ab0e2e8dd1a3f1b1c16/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 12:45:06 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2zrucvydb66fvjwyqvszqgdi3swo37mrxabrvmhc5dorupy3dqla._file
Verdict:
malicious
Similar samples:
0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
Formbook
0a5e60319a443610bd184d1d0140036332d56430e32976e79c6aeec24be7d701
Formbook
30906d9b754f0687ae3970b83f619a22cf338a478ef6a4165a8f7e378903f616
Formbook
43a4ccbc49a375bf9ee5bd085412f9e81bd4e9aba05db7e357dd95e04613a70b
Formbook
5d39d8514724cc23cd2f0265a46345bd10118e699516f3075b376def2004d5fb
Formbook
6cdda681496328866d2578f5134c0f87be9918419d6ad31f2e8a7b1b479f7a87
Formbook
8ccce2a5d01211e5db0bcc8721dbea06422c5f3133466e4945e4d301d44df3b2
Formbook
b54934cb8e1ff68d2c4306e5a6eb0f9e649ad1680960253c0cfa0c35a6c4d313
Formbook
c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9
Formbook
e1614a878888eddb3296e856dc5f4e63a926b9e4c899cf09da12a8f477ace4cf
Formbook
+ 678 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200702-xqm4pjyr6n/
Behaviour
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies system executable filetype association
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_neshta_g0
Create hunting rule
Author:gpalazolo
Description:This rule identifies Neshta Malware.
Reference:https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest

File information

The table below shows additional information about this malware sample such as delivery method and external references.

6ffed4be96deddf34b5fc5bf90cb056a8e94a981f0090dda252317c6e8a75824

Formbook

Executable exe d6634157030fbc5aa6d88565981868dcacedfd91b8031ab0e2e8dd1a3f1b1c16

(this sample)

  
Dropped by
MD5 e2c053995e46bdf1721cc3b8fbd36ad6
  
Dropped by
SHA256 6ffed4be96deddf34b5fc5bf90cb056a8e94a981f0090dda252317c6e8a75824
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/18467/

Comments