MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da32993754454442eef39fdeebd12d93d25299369f4db9c8bf64b6884a07c4ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da32993754454442eef39fdeebd12d93d25299369f4db9c8bf64b6884a07c4ed
SHA3-384 hash: cebe305551f2b84395e1add2d183e062237d038b60b99ded93a81ac9ce6f179d89a1f4bd65521acb94677bbc68d42b51
SHA1 hash: 07a9b3a7af93f5c5cb871786e38ec84aadce09dc
MD5 hash: d882358c1886e08a772c051220eeabed
humanhash: fruit-table-mirror-maine
File name:ap.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:361'051 bytes
First seen:2020-07-01 05:42:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e9c0657252137ac61c1eeeba4c021000 (53 x GuLoader, 26 x RedLineStealer, 17 x AgentTesla)
ssdeep 6144:j6dHIEHAElt4U6gDirbxLKRnvnjguUyS8tLkkS5f+sIwtmyN:K8ynfDGxQv0y/Lkj0q
Threatray 5'277 similar samples on MalwareBazaar
TLSH C77423062BD12CAFD5D34BF00BFAB262B27296012712154BFB306EBB9F65AC1D719153
Reporter oppimaniac
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/17574/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.43030161.1771.14598.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da32993754454442eef39fdeebd12d93d25299369f4db9c8bf64b6884a07c4ed/
Threat name:
Win32.Ransomware.MyxaH
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 05:44:06 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3izjsn2uivcef3xtt7poxujnspjffgjwt5g3tsf7ms3iqsqhytwq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
086616679314c8f75f9fa03cc722a56008166c8e9c8a63a653ed45d35628fdf4
FormBook
171bb4112c7a42e6ba98bb14516a15dc2a016f970e00e0d64224b5f76ebc6a77
FormBook
29247c960e16e376148704241453b7a008a62c050e9d11b2bba111452acb7fa3
FormBook
4c648b7b14b2eb3f4d58468a82684d68ee1ef6bed84a57545454de8849da9535
FormBook
6e2a6ffd8aa7c33dca7aa63dd89a4b30b4bcb78d4a31db6d03d1f2434cf94e23
FormBook
71143c4b78e1626ce16fc67c88e5237afe61c74ed256712f78aea97b79c5e890
FormBook
7af08bbd907a68770548426050115d6b0aeba599e0c3bd03c03f5ef8268ceb11
FormBook
b1d9adc8ee80f24960fb84adbb029695e49763faecbf559f92410d44bf28b0d3
FormBook
d4405060b30fab298c2747fc58ec301dfa160be2df3e335a78900fac044a2493
FormBook
db4aad17cb58975d3c42dc37b92e7c8bfdce82da52c5eb6a5e87709cf906a684
FormBook
+ 5'267 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
spyware evasion trojan stealer family:formbook persistence
Link:
https://tria.ge/reports/200701-gz1bhwv41x/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious behavior: MapViewOfSection
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Adds Run entry to start application
Reads user/profile data of web browsers
Loads dropped DLL
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe da32993754454442eef39fdeebd12d93d25299369f4db9c8bf64b6884a07c4ed

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/406669/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/17574/

Comments