MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0418e3df48284da14ab4d183c6d5d6ec3f37e3bd2b7be5439840d8409e620c32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0418e3df48284da14ab4d183c6d5d6ec3f37e3bd2b7be5439840d8409e620c32
SHA3-384 hash: a1cf07b2ee0dda3c69f0be6e7ca4291415ce9fa4924d066ee76d6161a26053341ea700e2b03d57b1977e4f0855a1797f
SHA1 hash: 8386873de7007f562a7af4873c445db0aeadb5d2
MD5 hash: 0b935188080502f956692bf5c3090949
humanhash: paris-maryland-nuts-mango
File name:Booking confirmation.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'159'690 bytes
First seen:2020-08-05 06:47:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 24576:bNA3R5drXdFdKbq2qxvUJnOH3s6N/gKKkg/XpMY5aRcKXi:G5NEBqxinFK9g/XG2aW
Threatray 4'281 similar samples on MalwareBazaar
TLSH 2E351202F7C588F1E67219324939BA60B9BC7C300E34CB6EF3D59A6C9930591A635F67
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: franceloc-postfix.filnet.fr
Sending IP: 194.187.193.120
From: BOOKING.COM <admin@booking.com>
Reply-To: finance.booking.com@outlook.com
Subject: GROUP CONFIRMATION
Attachment: Booking confirmation.rar (contains "Booking confirmation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38985/
Detection(s):
Win.Dropper.NetWire-9102409-0
Create hunting rule

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Setting browser functions hooks
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for files in the %temp% directory
Sending a UDP request
Creating a process from a recently created file
Creating a file
Adding an access-denied ACE
Launching cmd.exe command interpreter
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/410201
Signature
Allocates memory in foreign processes
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 257334 Sample: Booking confirmation.exe Startdate: 05/08/2020 Architecture: WINDOWS Score: 96 41 www.regular8.info 2->41 55 Malicious sample detected (through community Yara rule) 2->55 57 Yara detected FormBook 2->57 59 Drops PE files with a suspicious file extension 2->59 61 Modifies the prolog of user mode functions (user mode inline hooks) 2->61 12 Booking confirmation.exe 91 2->12         started        signatures3 process4 dnsIp5 45 192.168.2.1 unknown unknown 12->45 39 C:\Users\user\AppData\Local\...\dbmqbb.pif, PE32 12->39 dropped 16 dbmqbb.pif 3 12->16         started        file6 process7 file8 37 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 16->37 dropped 47 Writes to foreign memory regions 16->47 49 Allocates memory in foreign processes 16->49 51 Sample uses process hollowing technique 16->51 53 Injects a PE file into a foreign processes 16->53 20 RegSvcs.exe 16->20         started        23 RegSvcs.exe 16->23         started        signatures9 process10 signatures11 63 Modifies the context of a thread in another process (thread injection) 20->63 65 Maps a DLL or memory area into another process 20->65 67 Sample uses process hollowing technique 20->67 69 Queues an APC in another process (thread injection) 20->69 25 explorer.exe 20->25 injected 71 Tries to detect virtualization through RDTSC time measurements 23->71 process12 dnsIp13 43 www.likeavox.com 25->43 28 chkdsk.exe 25->28         started        31 autofmt.exe 25->31         started        process14 signatures15 73 Modifies the context of a thread in another process (thread injection) 28->73 75 Maps a DLL or memory area into another process 28->75 77 Tries to detect virtualization through RDTSC time measurements 28->77 33 cmd.exe 1 28->33         started        process16 process17 35 conhost.exe 33->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0418e3df48284da14ab4d183c6d5d6ec3f37e3bd2b7be5439840d8409e620c32/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:49:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aqmohx2ifbg2csvu2gb4nvow5q7tpy55fn56kq4yidmebhtcbqza._file
Verdict:
malicious
Similar samples:
0cd1ca47d2e04de65562e1ba4d8ce4545ee486999f8f0eb7adc880c7fb7fc9b8
Formbook
1678611ad4996f718c0a8998ce194dfe117bf47529c4ccad51a6816ecf4f1bb4
Formbook
5c5e4e31bde29168e03fa8cce36bab9b577568137edab59f68f8968616546ed9
Formbook
9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
Formbook
b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c
Formbook
c5b5ff5c176413573053cc64019bff9c9ca516d27fcbf2611505083c892c2751
Formbook
c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa
Formbook
d35f40a630b2e4b24ec76c354e1e66d927afe339aaba45ff3c750ed52193c910
Formbook
f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510
Formbook
fb0d1b0c62204ebfb2e04bcc607e562f398bf0cd40a275ace02ca34bed1d355d
Formbook
+ 4'271 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat persistence spyware trojan stealer family:formbook evasion
Link:
https://tria.ge/reports/200805-cadpp5dys2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious behavior: MapViewOfSection
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0418e3df48284da14ab4d183c6d5d6ec3f37e3bd2b7be5439840d8409e620c32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a8d0c90ba86afeb2b802d759fc91c30ed8adbf76cedb1164b99e94d8bfe47b31

Formbook

Executable exe 0418e3df48284da14ab4d183c6d5d6ec3f37e3bd2b7be5439840d8409e620c32

(this sample)

  
Dropped by
MD5 25aaffcd1a4954ef5167faeb4af2374b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38985/
  
Dropped by
SHA256 a8d0c90ba86afeb2b802d759fc91c30ed8adbf76cedb1164b99e94d8bfe47b31

Comments