MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e72dab4f75cd19899422ecf38de195bf487f0f9d2b0ccad98c13a48e9d782e97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e72dab4f75cd19899422ecf38de195bf487f0f9d2b0ccad98c13a48e9d782e97
SHA3-384 hash: 81dd8dd50e746cc14818761823cf2cdaee60f478e9527e4b21ee4acbc10e684043e9f99febb34af36ab00e9ac75f2008
SHA1 hash: ff565bd37e5eec9df3f8ee2a50c5b9abde13bcfb
MD5 hash: d9d83b8c625757096cfd230bb2571e03
humanhash: apart-violet-monkey-utah
File name:bbth00912.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:238'496 bytes
First seen:2021-08-18 21:01:21 UTC
Last seen:2021-08-18 21:58:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 987efec7b4ce55d90da19b9e2ec8d4da (4 x Formbook)
ssdeep 6144:SeE98fh+IGAS1eZyIAeTCURJLYe7cnpg1glVY:Smf0RZXsTlJSpg1glVY
Threatray 2 similar samples on MalwareBazaar
TLSH T1B4341206539CAB29D8A510344D1A697A1DB8BD79405F4287AFD0732E0BB4FC05A7EF33
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bbth00912.exe
Verdict:
Malicious activity
Analysis date:
2021-08-18 21:03:52 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/d6ec7d83-753c-4eeb-ba00-7b5ffd266842

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180467/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.43330.30014.23365.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/54d469cc-7d9a-4da8-9942-0106c544d2f5
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
23 / 100
Link:
https://www.joesandbox.com/analysis/835396
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 467827 Sample: bbth00912.exe Startdate: 18/08/2021 Architecture: WINDOWS Score: 23 13 Machine Learning detection for sample 2->13 6 bbth00912.exe 2->6         started        process3 process4 8 WerFault.exe 23 9 6->8         started        file5 11 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 8->11 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e72dab4f75cd19899422ecf38de195bf487f0f9d2b0ccad98c13a48e9d782e97/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-08-18 21:02:07 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=44w2wt3vzumytfbc5tzy3ymvx5eh6d45fmgmvwmmcosi5hlyf2lq._file
Verdict:
unknown
Similar samples:
1736c3f3d740011ba6f6d8f18def38d20f0bcbf88c3f69821db18578bc00590a
Formbook
9f8faf1ca8d3262940620bcb00487188e8657336cc3cb498ba4ad90ae96a59af
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:lt0h rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/210818-l9t9hcbr6a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.bulverderoofing.com/lt0h/
Unpacked files
SH256 hash:
4b0125cd7049dba92a565c874848edee6e6be3f6b32b6a934d9fec5cbd5e4099
MD5 hash:
dee8ae3d305808bd6a1f9fccd12db26a
SHA1 hash:
9112ec525f595e2dc0fff0bb39b7653cc689c028
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/1ff6509a-12be-4f8f-8ff7-6a19977490ab/
Parent samples :
b8f987a5099e1a1a220893763f00bcff9d84ed2dd49cb4a0ab8f5c595281e5ac
c3df575156e76cb9cafff48a4a88da1407c15ba32c4917f80c200f683d619f49
f0e734543c047d2ca1a76a4e47553e85d50c57ff9d3dfbd0e55806ff890fef38
9598f7ebeef58e063e6e5de7da5ea2775991628d11c4fae3e3e2854fa22065eb
8898f85efa9e25992b6e00da2b7d3338649ebf89d26a92b9bf156618960f5466
40bc59f1d4f063924c57d0cee83dcabb6e3aa2ea3122d99b32fcf09257c22a66
5e870c6ebc9666619f80ecb157b67de938fe42a7d17533d3705b5464923ff7f1
92c3ce5b263bedf0e55723eff317e03c62586173fed419e4f62f26c19835b4c5
164447ab2383bc200bebb32184a25f05f88ba3d96dd8c1302267252682be3112
e72dab4f75cd19899422ecf38de195bf487f0f9d2b0ccad98c13a48e9d782e97
e4145611fb9671662e34a829bbebdafa3bf22e16ec460c49939c52ccc3ba03d7
f4abecbd1a56abc36103d0595086bfd31c50f33236b9431b53860e5c1e20c2a7
SH256 hash:
e72dab4f75cd19899422ecf38de195bf487f0f9d2b0ccad98c13a48e9d782e97
MD5 hash:
d9d83b8c625757096cfd230bb2571e03
SHA1 hash:
ff565bd37e5eec9df3f8ee2a50c5b9abde13bcfb
Link:
https://www.unpac.me/results/1ff6509a-12be-4f8f-8ff7-6a19977490ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e72dab4f75cd19899422ecf38de195bf487f0f9d2b0ccad98c13a48e9d782e97

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe e72dab4f75cd19899422ecf38de195bf487f0f9d2b0ccad98c13a48e9d782e97

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/180467/

Comments