MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22722e6e6da1ce062caad041e121b74af35678e455cfc0de59c3ea1eeb469520. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22722e6e6da1ce062caad041e121b74af35678e455cfc0de59c3ea1eeb469520
SHA3-384 hash: 56f7a61309bc5f6e560d0abcb76003e07cf6a38c55abac8dc6128a6c994e720a26540703a1fe9e6df88f793cbfbf8498
SHA1 hash: 0fa02ff978cc75540c0ee2dca006e4a66ce9d5c3
MD5 hash: a21e01bef23ec4f2f0ad9d2e284d5985
humanhash: berlin-colorado-rugby-lamp
File name:Payment Confirmation Receipt.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:539'136 bytes
First seen:2020-08-17 08:04:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:U+Fo+qQ5+nyQ6WdqlaJMjc9FjwKbkfCema+J6+T2:VH17WyaKUNkfjmaE
Threatray 2'549 similar samples on MalwareBazaar
TLSH 7DB41213B6A8C002C13D1B73C98D568807B8B6C7B412EA5D7D9C32DA6D623DA4A56FC3
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: slot0.raef.ga
Sending IP: 173.82.57.10
From: Abdul Financial Center<admin>
Subject: Re: Invoice Payment Confirmation
Attachment: Payment Confirmation Receipt.rar (contains "Payment Confirmation Receipt.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/46780/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Modifying a system executable file
Launching a process
Creating a process with a hidden window
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/432798
Signature
.NET source code contains potential unpacker
Detected FormBook malware
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 268707 Sample: Payment Confirmation Receipt.exe Startdate: 17/08/2020 Architecture: WINDOWS Score: 100 53 Malicious sample detected (through community Yara rule) 2->53 55 Sigma detected: Scheduled temp file as task from temp location 2->55 57 Yara detected AntiVM_3 2->57 59 9 other signatures 2->59 10 Payment Confirmation Receipt.exe 7 2->10         started        process3 file4 39 C:\Users\user\AppData\RoamingDCNdPLX.exe, PE32 10->39 dropped 41 C:\Users\...DCNdPLX.exe:Zone.Identifier, ASCII 10->41 dropped 43 C:\Users\user\AppData\Local\...\tmp70CD.tmp, XML 10->43 dropped 45 C:\...\Payment Confirmation Receipt.exe.log, ASCII 10->45 dropped 71 Injects a PE file into a foreign processes 10->71 14 Payment Confirmation Receipt.exe 10->14         started        17 schtasks.exe 1 10->17         started        signatures5 process6 signatures7 73 Modifies the context of a thread in another process (thread injection) 14->73 75 Maps a DLL or memory area into another process 14->75 77 Sample uses process hollowing technique 14->77 79 Queues an APC in another process (thread injection) 14->79 19 explorer.exe 14->19 injected 23 conhost.exe 17->23         started        process8 dnsIp9 47 ourcooppower.com 173.239.98.244, 49759, 80 LNH-INCUS United States 19->47 49 www.zhejiangft.com 19->49 51 2 other IPs or domains 19->51 61 System process connects to network (likely due to code injection or exploit) 19->61 25 chkdsk.exe 1 17 19->25         started        29 autoconv.exe 19->29         started        signatures10 process11 file12 35 C:\Users\user\AppData\...\6NMlogrv.ini, data 25->35 dropped 37 C:\Users\user\AppData\...\6NMlogri.ini, data 25->37 dropped 63 Detected FormBook malware 25->63 65 Tries to steal Mail credentials (via file access) 25->65 67 Tries to harvest and steal browser information (history, passwords, etc) 25->67 69 3 other signatures 25->69 31 cmd.exe 1 25->31         started        signatures13 process14 process15 33 conhost.exe 31->33         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/22722e6e6da1ce062caad041e121b74af35678e455cfc0de59c3ea1eeb469520/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 03:24:43 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ejzc43tnuhhamlfk2ba6cinxjlzvm6hekxh4bxszypvb522gsuqa._file
Verdict:
malicious
Similar samples:
0b78886eb93cead61694ece663e18be3eb323923ea4cd45d5372aa1b6b78a90f
FormBook
5b52beb61f01acce45442d85adcc909eabc07d87fc006d35c9e37f5d8b69d2c2
FormBook
68fc1b87f19de1765e5dab39ebabef62e2acf44a61942918016dad9513e8b910
FormBook
6acc6132e2b715d36c680d06959661bc650756f8b464a5bc5bcdd8e6faa07a55
FormBook
823f72e280224715e6d4f7fff1f792d2c372d7633eab250f2308325eff114c18
FormBook
86339324135e2584d960711e0adad1563fe4d577ff72a5f0a715b8e1768ae69f
FormBook
93b54f00313eead297d3e2d93c4f84d023f862e524509dd31cd5bf58dfcd0631
FormBook
cbca1b2ee6c097f73a866a102f4f17a5966ede96d69b51d6702a0882181fa866
FormBook
e2ee2925682e188e41fcdf49f0274de4617fc3a9506ad31be7a9caeca6d21b38
FormBook
fa24e9a733aeaa416ab67d027251e33459cad727d3357d44c91c251d03282fa0
FormBook
+ 2'539 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200817-ca2qtrsl16/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.mansiobok2.info/2cte/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22722e6e6da1ce062caad041e121b74af35678e455cfc0de59c3ea1eeb469520

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 17ee5ffdb4705d741889bb71ab2881f2318b1f783ac89bc5a5231232aa98fe80

FormBook

Executable exe 22722e6e6da1ce062caad041e121b74af35678e455cfc0de59c3ea1eeb469520

(this sample)

  
Dropped by
MD5 02339ae503e5ff38d0fb6c6a022c38ee
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/46780/
  
Dropped by
SHA256 17ee5ffdb4705d741889bb71ab2881f2318b1f783ac89bc5a5231232aa98fe80

Comments