MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510
SHA3-384 hash: 4d8f468e43c53e5833090090af040b4e4a1de02d5b4ba42a9f632560a43627b762d6c568eec612f35db862c2262ac8e9
SHA1 hash: 1a4e677c600792b67cbbf23db45fc5119ace807f
MD5 hash: 20309cd20656f768b78cf8ee47aba6bd
humanhash: ohio-crazy-leopard-potato
File name:Quotation.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'114'859 bytes
First seen:2020-07-09 07:32:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 24576:6NA3R5drXdtseVi6gxo5PtkK/gAqX7yUMlJXyCazFQYcaMnY6FKX:z5bhViEtkKnlUMlRyZ66wFKX
Threatray 5'348 similar samples on MalwareBazaar
TLSH AB351202BAC344B1D97319364D3EE720AA7D7A701F38CE1F77E409AD8A355819635BA3
Reporter abuse_ch
Tags:exe FormBook Outlook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: APC01-SG2-obe.outbound.protection.outlook.com
Sending IP: 40.92.253.83
From: Notification Team <vubengineering@hotmail.com>
Subject: REQUEST FOR QUOTATION
Attachment: Quotation.uue (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/23496/
Detection(s):
SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Creating a window that notifies about a problem with the file start
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 03:09:55 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6fr7i6enudkelxwgq7px2ik3nlz4jpvbawe7ujuonl7sb7ztkuia._file
Verdict:
malicious
Similar samples:
0cd1ca47d2e04de65562e1ba4d8ce4545ee486999f8f0eb7adc880c7fb7fc9b8
FormBook
251c55b7c7c02eec9a87eca94bb01f653317ef5d8278aeb2b511194d7057a675
FormBook
5c5e4e31bde29168e03fa8cce36bab9b577568137edab59f68f8968616546ed9
FormBook
69f0daa863cb586a1e2b00b6335bc69f7f06615b44b2f81bb5445d6912f6a80e
FormBook
7054e09e939cb0fe23629b11e08c8f299d54694babb5db98df8ead30a9233866
FormBook
787e032a02ff81b42fa794cc31a55e149cee73a366fa3980bb8da4d05c511834
FormBook
9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
FormBook
ab837860c80711ebd28b745c4794d39d6cdf49281404fac8bbbec29f3a5e1e24
FormBook
b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c
FormBook
d6bf71b068bc124e0c9200cad32906d1aceb3e57ff99a695073f235b83ffb0fb
FormBook
+ 5'338 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
persistence spyware trojan stealer family:formbook evasion
Link:
https://tria.ge/reports/200709-wk2d4xtrts/
Behaviour
Suspicious behavior: MapViewOfSection
System policy modification
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Checks whether UAC is enabled
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
Adds Run entry to policy start application
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

uue 679a06d901ce3cc19b8b6988eb69867716204b7c7ab7b890f51b6cd7341afbe9

FormBook

Executable exe f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510

(this sample)

  
Dropped by
MD5 1721bef130b4d6c9a337b9e94a4af6c7
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/23496/
  
Dropped by
SHA256 679a06d901ce3cc19b8b6988eb69867716204b7c7ab7b890f51b6cd7341afbe9

Comments