MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 File information Yara 4 Comments
Add tag Delete this sample Report a False Positive

SHA256 hash: 01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0
SHA3-384 hash: 91105a1323859f203b97294c4e3b30378db6f4bbeecda3044fbcad1de49e39877a80d7d49fc033045b6ee0b03a1be3bb
SHA1 hash: 40e67eef7c001a8752763616fc9a58170721c27a
MD5 hash: 18ec78e09155c046a203fb4dcbc3593f
humanhash: carbon-social-paris-foxtrot
File name:0O9BJfVJi6fEMoS.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:816'640 bytes
First seen:2021-02-23 07:16:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:kxwz1c/yd0cGqrtttttwgGCyWI+XEmlm4gA2YhFp0ksvQZIcQXzjUIBElb6oBbc3:J/wCEzmg4sYhgkqXzwOw47Zf5
Threatray 3'989 similar samples on MalwareBazaar
TLSH C0056B1063F88A54F5B62B71987FDF702B727C96B835D25E1E8035EF2971B408AA1723
Reporter @abuse_ch
Tags:exe FormBook Yahoo


Twitter
@abuse_ch
Malspam distributing Formbook:

HELO: sonic310-23.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.186.204
From: HASSAN EJIWUNMI <haejiwunmi@yahoo.com>
Subject: Transfer Payment copy
Attachment: AccXX8853.rar (contains "0O9BJfVJi6fEMoS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/118478/
Detection(s):
Win.Malware.Fareit-7344121-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/615090
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 356555 Sample: 0O9BJfVJi6fEMoS.exe Startdate: 23/02/2021 Architecture: WINDOWS Score: 100 35 www.grandwhale.com 2->35 37 www.smallbathroomdecor.info 2->37 39 HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com 2->39 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 4 other signatures 2->53 11 0O9BJfVJi6fEMoS.exe 3 2->11         started        signatures3 process4 file5 33 C:\Users\user\...\0O9BJfVJi6fEMoS.exe.log, ASCII 11->33 dropped 63 Tries to detect virtualization through RDTSC time measurements 11->63 65 Injects a PE file into a foreign processes 11->65 15 0O9BJfVJi6fEMoS.exe 11->15         started        18 0O9BJfVJi6fEMoS.exe 11->18         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 15->67 69 Maps a DLL or memory area into another process 15->69 71 Sample uses process hollowing technique 15->71 73 Queues an APC in another process (thread injection) 15->73 20 explorer.exe 15->20 injected process9 dnsIp10 41 dgcsales.net 184.106.16.223, 49764, 80 RACKSPACEUS United States 20->41 43 www.besteprobioticakopen.online 94.23.162.163, 49770, 80 OVHFR France 20->43 45 17 other IPs or domains 20->45 55 System process connects to network (likely due to code injection or exploit) 20->55 24 explorer.exe 20->24         started        27 autofmt.exe 20->27         started        signatures11 process12 signatures13 57 Modifies the context of a thread in another process (thread injection) 24->57 59 Maps a DLL or memory area into another process 24->59 61 Tries to detect virtualization through RDTSC time measurements 24->61 29 cmd.exe 1 24->29         started        process14 process15 31 conhost.exe 29->31         started       
Detection:
n/a
Create hunting rule
Link:
https://mwdb.cert.pl/sample/01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0/
Threat name:
Win32.Spyware.Convagent
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 04:54:35 UTC
AV detection:
10 of 46 (21.74%)
Threat level
  2/5
Detection(s):
Suspicious file
Link:
https://www.spamhaus.org/query/hash/ahc2zasbogqwirz5simh7abr6k6hcazzp7stj5lhohmosweuixqa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
00b4306bf3aa94183358ece86c01bb245ca2e39ba0a2d56f5b9d8b50c3ba3e91
Formbook
17adca833d9ccaf731ac41830d08db7b447ff391ce54052532d4d90fb4594a40
Formbook
1c2c212dbad3b81d9c6225c3a9f9f6211b10782d228a090f9aa4f038b0270663
Formbook
4136247829572b4210102e01bef684b8e5cbc8ebd9d8dc6a87de79ca62a51630
Formbook
65ca40e44ab6171794b0c81d8b80122604eff3aca4614901fcd30db1a5329cfb
Formbook
a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570
Formbook
c408e9ac6c785de60c7a65c278c476165c660547645ff34ace23767ee2d16021
Formbook
f1cb70b8963d11aab0392a24161c0851f2d320d62aa101c3f960bcf0d7d94619
Formbook
fac8654450974c4648e94d6e8cbc40a1afcb538ff5b35f551b2a876d7b03cb36
Formbook
fe30613b322753635f37763ebfeb63e065629b56e2924e51dc188f24be3f05d6
Formbook
+ 3'979 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader loader rat spyware stealer trojan
Link:
https://tria.ge/reports/210223-p1c7wr1vka/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Formbook
Xloader
Malware Config
C2 Extraction:
http://www.besteprobioticakopen.online/uszn/
Unpacked files
SH256 hash:
1820c232000eaca2b342006581d1e0743ff2166f57f917b8691901867e7ad3e0
MD5 hash:
cc0ba93bd12ee998cacab013043ff2c6
SHA1 hash:
c5ca7761965d1eedceaab08eb3bc06963292bd87
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/6a092d6a-da65-4cbb-827a-4e237783c4e0/
Parent samples :
65ca40e44ab6171794b0c81d8b80122604eff3aca4614901fcd30db1a5329cfb
00b4306bf3aa94183358ece86c01bb245ca2e39ba0a2d56f5b9d8b50c3ba3e91
fe30613b322753635f37763ebfeb63e065629b56e2924e51dc188f24be3f05d6
f1cb70b8963d11aab0392a24161c0851f2d320d62aa101c3f960bcf0d7d94619
17adca833d9ccaf731ac41830d08db7b447ff391ce54052532d4d90fb4594a40
c408e9ac6c785de60c7a65c278c476165c660547645ff34ace23767ee2d16021
01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0
SH256 hash:
fa711b383bec96741b45efd3fc097c051676af475cd6035e196c8147d7c26400
MD5 hash:
f0be5b94d2d7dfa7247d68e674bba339
SHA1 hash:
f764cc23572b60e802163c9496b92f4ef3d61345
Link:
https://www.unpac.me/results/6a092d6a-da65-4cbb-827a-4e237783c4e0/
SH256 hash:
f0a09c48af16c079c37ad0914f18897976357981fe5ee6f556ab9f9f70b9a671
MD5 hash:
f984a71581f6da5732110be2a569a392
SHA1 hash:
10de05b6b35fc5dbc00c42d59a4b850bcaae01e6
Link:
https://www.unpac.me/results/6a092d6a-da65-4cbb-827a-4e237783c4e0/
SH256 hash:
01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0
MD5 hash:
18ec78e09155c046a203fb4dcbc3593f
SHA1 hash:
40e67eef7c001a8752763616fc9a58170721c27a
Link:
https://www.unpac.me/results/6a092d6a-da65-4cbb-827a-4e237783c4e0/
Threat name:
Suspicious File
Score:
0.55

Yara Signatures

Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 87ee577f00d453798ca357052e746159388306277d41f1f381dfeccc92ed94ed

Formbook

Executable exe 01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0

(this sample)

  
Dropped by
MD5 6f5f0d462ab21b545b8c211f1fb36562
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/118478/
  
Dropped by
SHA256 87ee577f00d453798ca357052e746159388306277d41f1f381dfeccc92ed94ed

Comments