MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bccd7c0c084c310cc99b76682f6747baebaec683536a1ec3a8210b55daa327a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bccd7c0c084c310cc99b76682f6747baebaec683536a1ec3a8210b55daa327a
SHA3-384 hash: 734567684b4a053f7e31feeeec62e02a8a95d68e478c675836a1978cad3815e40fefe9d9921c5629f0f7da81e369b028
SHA1 hash: 15af9a208261b5257057ea81498052fed0fc5f31
MD5 hash: 378e07dcab913a884f30596e17317915
humanhash: island-zulu-thirteen-ohio
File name:PAYSLIP.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:625'152 bytes
First seen:2020-08-14 08:54:23 UTC
Last seen:2020-08-14 09:42:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:d1/AfxLfTDZIWKBgO6lBtqo2qRy0mZ4yA:AfxjHnOgO6lBKqRy0J
Threatray 3'500 similar samples on MalwareBazaar
TLSH 45D4BF7152984B91E43D9BB85131140003F37D29EB36EE5DBEBA72A90F77BD20273A16
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

From: Jian Zheng <server@hinet.net>
Subject: Please confirm payment
Attachment: PAYSLIP.zip (contains "PAYSLIP.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/45670/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.22568.25323.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/429084
Signature
.NET source code contains potential unpacker
Benign windows process drops PE files
Detected FormBook malware
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 267030 Sample: PAYSLIP.exe Startdate: 15/08/2020 Architecture: WINDOWS Score: 100 45 www.shjdfc.com 2->45 47 www.shjdfc.com.cname.yunjiasu-cdn.net 2->47 55 Malicious sample detected (through community Yara rule) 2->55 57 Yara detected AntiVM_3 2->57 59 Yara detected FormBook 2->59 61 5 other signatures 2->61 11 PAYSLIP.exe 3 2->11         started        signatures3 process4 file5 43 C:\Users\user\AppData\...\PAYSLIP.exe.log, ASCII 11->43 dropped 75 Tries to detect virtualization through RDTSC time measurements 11->75 77 Injects a PE file into a foreign processes 11->77 15 PAYSLIP.exe 11->15         started        signatures6 process7 signatures8 79 Modifies the context of a thread in another process (thread injection) 15->79 81 Maps a DLL or memory area into another process 15->81 83 Sample uses process hollowing technique 15->83 85 Queues an APC in another process (thread injection) 15->85 18 explorer.exe 3 6 15->18 injected process9 dnsIp10 49 www.matthewjgardner.com 18->49 51 www.li021.com 18->51 53 ext-sq.squarespace.com 198.185.159.144, 49748, 80 SQUARESPACEUS United States 18->53 37 C:\Users\user\AppData\...\mfc4hc8ftbp.exe, PE32 18->37 dropped 63 System process connects to network (likely due to code injection or exploit) 18->63 65 Benign windows process drops PE files 18->65 23 chkdsk.exe 1 17 18->23         started        27 mfc4hc8ftbp.exe 2 18->27         started        29 mfc4hc8ftbp.exe 2 18->29         started        file11 signatures12 process13 file14 39 C:\Users\user\AppData\...\15Nlogrv.ini, data 23->39 dropped 41 C:\Users\user\AppData\...\15Nlogri.ini, data 23->41 dropped 67 Detected FormBook malware 23->67 69 Tries to steal Mail credentials (via file access) 23->69 71 Tries to harvest and steal browser information (history, passwords, etc) 23->71 73 3 other signatures 23->73 31 cmd.exe 1 23->31         started        33 mfc4hc8ftbp.exe 27->33         started        signatures15 process16 process17 35 conhost.exe 31->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bccd7c0c084c310cc99b76682f6747baebaec683536a1ec3a8210b55daa327a/
Threat name:
ByteCode-MSIL.Trojan.LokiSteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 08:56:07 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fpgnpqgaqtbrbtezw5tif5tupoxlv3digu3kd3b2qiilkxnkgj5a._file
Verdict:
malicious
Similar samples:
0e596eee578e5cc009d172a7dbae0cf150bbf925360389b9961e67c60ab8f3a2
FormBook
23f5c4c38dc1ab5c57de98087bdc5ed23a2a0b123293526eb496dae8e9311e2d
FormBook
327bc1ad9fc793811e5da6cb3553b7dca05c8a48d8060fc94015339ee805851d
FormBook
5d23715d3724a6a10e1af754d9fd8209a399164c65d020eceaa8aa1ff93879be
FormBook
60c5ac0b248ca937816d4ec153cfe39bd50f21668e32aa5cd059c1a1aae1315c
FormBook
8288e9e21f28be24c2d3839e26c3c726dc90e9955a8506816fb498044f9846b6
FormBook
a3146b5cf5e3e45e07943cd02d6b2758acce9213ffb3b33dc4f0c098d54dd58b
FormBook
aeccef59002b851b685cf54307f906c06adb065b68c3eff112f4b0f1442d1349
FormBook
b91d1df833c959a0c941ea92dae9d30f23cb4825ae33594da4eafc758a8de10f
FormBook
f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e
FormBook
+ 3'490 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200814-vafblrzm16/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.godhep.com/vcd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2bccd7c0c084c310cc99b76682f6747baebaec683536a1ec3a8210b55daa327a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 0e234ba687dd6bc123e8e3da1412f7e8bba502fca6559accd526ec19ee779019

FormBook

Executable exe 2bccd7c0c084c310cc99b76682f6747baebaec683536a1ec3a8210b55daa327a

(this sample)

  
Dropped by
MD5 55c161c75eebba86b2dddb702f7e170f
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/45670/
  
Dropped by
SHA256 0e234ba687dd6bc123e8e3da1412f7e8bba502fca6559accd526ec19ee779019

Comments