MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Formbook


Vendor detections: 11


Intelligence 11 File information Yara 4 Comments

SHA256 hash: 01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0
SHA3-384 hash: 91105a1323859f203b97294c4e3b30378db6f4bbeecda3044fbcad1de49e39877a80d7d49fc033045b6ee0b03a1be3bb
SHA1 hash: 40e67eef7c001a8752763616fc9a58170721c27a
MD5 hash: 18ec78e09155c046a203fb4dcbc3593f
humanhash: carbon-social-paris-foxtrot
File name:0O9BJfVJi6fEMoS.exe
Download: download sample
Signature Formbook
File size:816'640 bytes
First seen:2021-02-23 07:16:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:kxwz1c/yd0cGqrtttttwgGCyWI+XEmlm4gA2YhFp0ksvQZIcQXzjUIBElb6oBbc3:J/wCEzmg4sYhgkqXzwOw47Zf5
Threatray 3'989 similar samples on MalwareBazaar
TLSH C0056B1063F88A54F5B62B71987FDF702B727C96B835D25E1E8035EF2971B408AA1723
Reporter @abuse_ch
Tags:exe FormBook Yahoo


Twitter
@abuse_ch
Malspam distributing Formbook:

HELO: sonic310-23.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.186.204
From: HASSAN EJIWUNMI <haejiwunmi@yahoo.com>
Subject: Transfer Payment copy
Attachment: AccXX8853.rar (contains "0O9BJfVJi6fEMoS.exe")

Intelligence


File Origin
# of uploads :
1
# of downloads :
50
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 356555 Sample: 0O9BJfVJi6fEMoS.exe Startdate: 23/02/2021 Architecture: WINDOWS Score: 100 35 www.grandwhale.com 2->35 37 www.smallbathroomdecor.info 2->37 39 HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com 2->39 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 4 other signatures 2->53 11 0O9BJfVJi6fEMoS.exe 3 2->11         started        signatures3 process4 file5 33 C:\Users\user\...\0O9BJfVJi6fEMoS.exe.log, ASCII 11->33 dropped 63 Tries to detect virtualization through RDTSC time measurements 11->63 65 Injects a PE file into a foreign processes 11->65 15 0O9BJfVJi6fEMoS.exe 11->15         started        18 0O9BJfVJi6fEMoS.exe 11->18         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 15->67 69 Maps a DLL or memory area into another process 15->69 71 Sample uses process hollowing technique 15->71 73 Queues an APC in another process (thread injection) 15->73 20 explorer.exe 15->20 injected process9 dnsIp10 41 dgcsales.net 184.106.16.223, 49764, 80 RACKSPACEUS United States 20->41 43 www.besteprobioticakopen.online 94.23.162.163, 49770, 80 OVHFR France 20->43 45 17 other IPs or domains 20->45 55 System process connects to network (likely due to code injection or exploit) 20->55 24 explorer.exe 20->24         started        27 autofmt.exe 20->27         started        signatures11 process12 signatures13 57 Modifies the context of a thread in another process (thread injection) 24->57 59 Maps a DLL or memory area into another process 24->59 61 Tries to detect virtualization through RDTSC time measurements 24->61 29 cmd.exe 1 24->29         started        process14 process15 31 conhost.exe 29->31         started       
Threat name:
Win32.Spyware.Convagent
Status:
Malicious
First seen:
2021-02-23 04:54:35 UTC
AV detection:
10 of 46 (21.74%)
Threat level
  2/5
Result
Malware family:
xloader
Score:
  10/10
Tags:
family:formbook family:xloader loader rat spyware stealer trojan
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Formbook
Xloader
Malware Config
C2 Extraction:
http://www.besteprobioticakopen.online/uszn/
Unpacked files
SH256 hash:
fa711b383bec96741b45efd3fc097c051676af475cd6035e196c8147d7c26400
MD5 hash:
f0be5b94d2d7dfa7247d68e674bba339
SHA1 hash:
f764cc23572b60e802163c9496b92f4ef3d61345
SH256 hash:
f0a09c48af16c079c37ad0914f18897976357981fe5ee6f556ab9f9f70b9a671
MD5 hash:
f984a71581f6da5732110be2a569a392
SHA1 hash:
10de05b6b35fc5dbc00c42d59a4b850bcaae01e6
SH256 hash:
01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0
MD5 hash:
18ec78e09155c046a203fb4dcbc3593f
SHA1 hash:
40e67eef7c001a8752763616fc9a58170721c27a
Threat name:
Suspicious File
Score:
0.55

Yara Signatures


Rule name:crime_win32_ransom_avaddon_1
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:RSharedStrings
Author:Katie Kleemola
Description:identifiers for remote and gmremote

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments