MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de129b85c2c4cd0e7d1817d2a8b3095d02ef8880f6273c88c0ff3cd48a9a9dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de129b85c2c4cd0e7d1817d2a8b3095d02ef8880f6273c88c0ff3cd48a9a9dd8
SHA3-384 hash: cfa924dbe8d9446e1b0dd757ad6a9c0a0662cf3fe62fb2c7512c866ccfea5b95715bdebb3fb1329c82e2669582e56fec
SHA1 hash: e26c244376810763f5e3e6e3dd5aca4da287fd93
MD5 hash: b4d96c55f676d81285ae41fb7eb0b20e
humanhash: blossom-violet-magnesium-mango
File name:list of our order.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:776'704 bytes
First seen:2020-07-02 14:34:40 UTC
Last seen:2020-07-02 15:54:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b1ecbfe14f1b02bb968bc23b7ab0cd64 (1 x Formbook)
ssdeep 12288:/Q8OKzOIkZvIGuRGoS0fmzJmMFodGvhFe3aUxS2ki553abp:5OKz+RuRpSllCae3aUx155
Threatray 2'185 similar samples on MalwareBazaar
TLSH 93F4AF12B7D1C432C46326399C6BBBB86A39FE00692496472BA47D9CFF357913D32253
Reporter jarumlus

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/18502/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/de129b85c2c4cd0e7d1817d2a8b3095d02ef8880f6273c88c0ff3cd48a9a9dd8/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 12:55:03 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3yjjxbocytgq47iyc7jkrmyjlubo7cea6yttzcga746njcu2txma._file
Verdict:
malicious
Similar samples:
017f433a49afcc765c5a5e7f39de6251fbe37d9c98f7d86f1abcefb1a9f559bc
Formbook
2ee68069c79304ab2bc383e02c7d9f07ecdc9f91e9680afe381c72715225a89e
Formbook
41519f4cbc28650e8151b62f9a6b9503274a80d6dc51bade4a118812742e63ab
Formbook
61ce52bb7cf517275e2bea379104a392630ec8dc216790a910f4586efbdca4fb
Formbook
8afd54f2ed0af6d9593b0985cec1604748ca753900859fe4ee225d21b574e55e
Formbook
91ff383b66f03166257bbf629acfab862c2269e04b76bc49714520a5709e5e72
Formbook
93fc98148dbcc6f16b8f6ca1d8bd6bc68eafb2b4b68e697135561f5845cf82b8
Formbook
a6534d12c87d0d8093cad2787b01a05c6caa0771f1b1cb51b809ee1ae9f48044
Formbook
be29f9be4b998a7893c2c182c972406067eaf913364484a1fa824133d71ef54f
Formbook
e95f01bbde0fbd70670b820b972768e7fc5f23509495c805ddbc3271030f443c
Formbook
+ 2'175 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
evasion trojan spyware stealer family:formbook persistence
Link:
https://tria.ge/reports/200702-p38yxdef6a/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
System policy modification
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Deletes itself
Reads user/profile data of web browsers
Adds Run entry to policy start application
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 796c17bb38138f832223c0bce9ae91db23de12054904887f09f04cca9df17ff9

Formbook

Executable exe de129b85c2c4cd0e7d1817d2a8b3095d02ef8880f6273c88c0ff3cd48a9a9dd8

(this sample)

  
Dropped by
MD5 219ea3049618ffc557b3554fdf4d3430
  
Dropped by
SHA256 796c17bb38138f832223c0bce9ae91db23de12054904887f09f04cca9df17ff9
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/18502/

Comments