MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed3318102d772c4dcecfb1e10f37cfd3fdcbaff1d340ba9c2bc5dcfe6383f339. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed3318102d772c4dcecfb1e10f37cfd3fdcbaff1d340ba9c2bc5dcfe6383f339
SHA3-384 hash: 8f5769ef5fa7d271b672d49969ebf015651af56bad98c465fbbe6e2766f01c2985104c5faa3a63597055151d7a87f97c
SHA1 hash: 291996028f7df646794aef71199200c4d72aa6bc
MD5 hash: e9401ef816354b65fc208d692fa8b94c
humanhash: victor-lake-texas-undress
File name:e9401ef816354b65fc208d692fa8b94c.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:622'080 bytes
First seen:2020-05-10 18:13:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:1QmM9g5U1+JJL7XJAnY72FhYScCppFkMFoAMUKDRAMQRgfmxld:OzgHJHX+nO2DYynFoAMs
Threatray 4'896 similar samples on MalwareBazaar
TLSH 7AD4BF372A418418C1BD86F1946E0AF2563B0EC83A45569F63EA7328DFF39477F1A21D
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Formbook-7399661-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-10 18:35:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5uzrqebno4we3twpwhqq6n6p2p64xl7r2nalvhblyxop4y4d6m4q._file
Verdict:
malicious
Similar samples:
4923037fb58a4491f08c85e0cf38a74d92dd36860932814170dc942a031bad2f
FormBook
61e169cb08c5e3b163370cd992574347625e887eca583922412ddfaed2d6bd10
FormBook
7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6
FormBook
8e5e93b6f3eee7f1a08a0420b25105017d3479769e6bf9d6b2518d3abc6b1a75
FormBook
a0d38e74310877d9ee7a4d0e75e25272adb25199527d19bc08c0f1ebb21f9ce6
FormBook
a85f53a7ad2f536d245e47535007f2bceacfa10f08d7f3f6568781dd1794caa0
FormBook
a91c5af7a94238bb1556b641b9f5bc7798133b3d699a9f3d5b88b8f8fc12f091
FormBook
addd4ba4b4aa754501d638cbbf3c78bec538ca15a72acb5eadc7babfaecfa350
FormBook
b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c
FormBook
ceec91127018aba0be51981277015baf08e3f0ef6fbd0a5efe5821fa698ba645
FormBook
+ 4'886 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-dackmqmwsx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://www.mansiobok2.info/mnf3/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe ed3318102d772c4dcecfb1e10f37cfd3fdcbaff1d340ba9c2bc5dcfe6383f339

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/358705/
  
Delivery method
Distributed via web download

Comments