MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 062778fce91ba3c9ecc4b3cc3cb5b4e3f41846699307fe2da8295c3b3da0339d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 062778fce91ba3c9ecc4b3cc3cb5b4e3f41846699307fe2da8295c3b3da0339d
SHA3-384 hash: 2ce766c96e52047353d1b026029dd2468ec0ed460a61958b8245332c741a69517d22120bd949a332130626c09da9bf93
SHA1 hash: 0a156687ac4a428354a224cec82576e2872031e9
MD5 hash: 4deba1639a8052a297693289210e7d8f
humanhash: eleven-michigan-mars-stream
File name:19882772020_pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:755'712 bytes
First seen:2020-07-21 06:27:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d8412990f74f880a4a63b66fdb523827 (11 x AgentTesla, 8 x Loki, 5 x FormBook)
ssdeep 12288:+ZnGUxq0RwFvcGHq8TxFsb4mOKKEzem/nfw0RCDuVH6N3TjQ1Z3nxQFsNK:AGuqtFvm8TxmZlzfffw0sGHCsnGMK
Threatray 4'951 similar samples on MalwareBazaar
TLSH 6CF4A066F2D00837C16B2B3F9C1B9765A829BF5D2A28998727F41CCC5F3978134361A7
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: apple.itnti.net
Sending IP: 217.174.251.133
From: logistics <logistics@amosgroup.com>
Reply-To: logistics@arnosgroup.com
Subject: RE: FW: orders in AMOS - EAGLE VERONA*Busan call 19882772020
Attachment: 19882772020_pdf.zip (contains "19882772020_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/29701/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/392494
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 248427 Sample: 19882772020_pdf.exe Startdate: 21/07/2020 Architecture: WINDOWS Score: 100 50 Multi AV Scanner detection for domain / URL 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 Multi AV Scanner detection for dropped file 2->54 56 8 other signatures 2->56 10 19882772020_pdf.exe 2->10         started        process3 signatures4 74 Detected unpacking (changes PE section rights) 10->74 76 Maps a DLL or memory area into another process 10->76 78 Tries to detect virtualization through RDTSC time measurements 10->78 80 Contains functionality to detect sleep reduction / modifications 10->80 13 19882772020_pdf.exe 10->13         started        process5 signatures6 82 Modifies the context of a thread in another process (thread injection) 13->82 84 Maps a DLL or memory area into another process 13->84 86 Sample uses process hollowing technique 13->86 88 Queues an APC in another process (thread injection) 13->88 16 explorer.exe 1 6 13->16 injected process7 dnsIp8 44 www.glamotd.com 63.250.47.83, 49715, 80 NAMECHEAP-NETUS United States 16->44 46 www.www4915a.com 16->46 48 www.stoxcrypto.com 16->48 36 C:\Users\user\AppData\...\y2kdth7nrtlvnp.exe, PE32 16->36 dropped 58 System process connects to network (likely due to code injection or exploit) 16->58 60 Benign windows process drops PE files 16->60 21 colorcpl.exe 1 18 16->21         started        25 y2kdth7nrtlvnp.exe 16->25         started        27 explorer.exe 16->27         started        file9 signatures10 process11 file12 38 C:\Users\user\AppData\...\--8logrv.ini, data 21->38 dropped 40 C:\Users\user\AppData\...\--8logri.ini, data 21->40 dropped 42 C:\Users\user\AppData\...\--8logrf.ini, data 21->42 dropped 62 Detected FormBook malware 21->62 64 Tries to steal Mail credentials (via file access) 21->64 66 Tries to harvest and steal browser information (history, passwords, etc) 21->66 68 Modifies the context of a thread in another process (thread injection) 21->68 29 cmd.exe 1 21->29         started        70 Maps a DLL or memory area into another process 25->70 31 y2kdth7nrtlvnp.exe 25->31         started        72 Tries to detect virtualization through RDTSC time measurements 27->72 signatures13 process14 signatures15 34 conhost.exe 29->34         started        90 Modifies the context of a thread in another process (thread injection) 31->90 92 Maps a DLL or memory area into another process 31->92 94 Sample uses process hollowing technique 31->94 process16
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/062778fce91ba3c9ecc4b3cc3cb5b4e3f41846699307fe2da8295c3b3da0339d/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:29:08 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aytxr7hjdor4t3gewpgdznnu4p2bqrtjsmd74lniffodwpnagooq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
4ad5c25440866b278662c4410e30147f8d0dc94c7c4024d56955174ed608d3a9
FormBook
6e2a6ffd8aa7c33dca7aa63dd89a4b30b4bcb78d4a31db6d03d1f2434cf94e23
FormBook
720f6f2a125359d8b85eea767c95d0059cb46eba2fc05a53bcfbf73b5bfc8531
FormBook
7af08bbd907a68770548426050115d6b0aeba599e0c3bd03c03f5ef8268ceb11
FormBook
7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6
FormBook
a35d69993515cae4a630d53eed0c26a8bb5c9026db01caba7b4e8a07075d209a
FormBook
a9f95f4853acbd95142dba6914c2c87ad89d1c1db87ae6ea95ada23d63635c9d
FormBook
c9f7661a1a814820db663d5a916abd38a6c824429542e8b833c9a4e67974ac80
FormBook
ceee0c8772c6b5a2cff7d9f3bc824c088f3c7d034b9898c74f79e11b59210257
FormBook
f4f6a523d411d3407372f81a18fe32a078e36c3715cf3b88f60fe05e6eb37fba
FormBook
+ 4'941 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
evasion trojan spyware stealer family:formbook persistence
Link:
https://tria.ge/reports/200721-bezlzk36rs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Adds Run key to start application
Deletes itself
Reads user/profile data of web browsers
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.46
Link:
https://yomi.yoroi.company/submissions/062778fce91ba3c9ecc4b3cc3cb5b4e3f41846699307fe2da8295c3b3da0339d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip a8631fcb21c9b2c30fac2eb2f1c89434e37e069489a147ff9bc1292c8f9c9ed7

FormBook

Executable exe 062778fce91ba3c9ecc4b3cc3cb5b4e3f41846699307fe2da8295c3b3da0339d

(this sample)

  
Dropped by
MD5 318c646f7a9399d135ef550ba6309f37
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/29701/
  
Dropped by
SHA256 a8631fcb21c9b2c30fac2eb2f1c89434e37e069489a147ff9bc1292c8f9c9ed7

Comments