MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ee68069c79304ab2bc383e02c7d9f07ecdc9f91e9680afe381c72715225a89e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ee68069c79304ab2bc383e02c7d9f07ecdc9f91e9680afe381c72715225a89e
SHA3-384 hash: 84e8ba7f67f45567b700d2622612b9c1bde085343ee0ce7735f1147aaf4d097c7d099232f4016b622efd2254241acb4d
SHA1 hash: 8af9ed06aa4e8a66cfd1a138d5bb826ad1692308
MD5 hash: 688b7416a90b3c3b4278926a403dc1fc
humanhash: ten-fanta-football-iowa
File name:lista de noi comenzi.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'516'146 bytes
First seen:2020-07-28 21:46:40 UTC
Last seen:2020-07-29 04:18:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 908ca3ebf1ae8340a627b01ca8fea614 (2 x Formbook)
ssdeep 24576:UaafUy2B0jAZTCUZgMlXIqOUArsqmyiSCyiSVUJEq7zvVJf9w9:Ua4mXZTCUZVhlZfyiSCyiSV/CznFw9
Threatray 5'445 similar samples on MalwareBazaar
TLSH 3C65CF22F1D2F17DC3AE4AF94CBDBB285518FD4136005C8AA1F93C6AC536A40A8D775E
Reporter Racco42
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/34042/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43557693.22955.1733.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EUFA.3234.26930.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/401019
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Creates a thread in another existing process (thread injection)
Detected FormBook malware
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 252747 Sample: lista de noi comenzi.exe Startdate: 29/07/2020 Architecture: WINDOWS Score: 100 32 www.liqourforyou.com 2->32 34 liqourforyou.com 2->34 36 2 other IPs or domains 2->36 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 5 other signatures 2->46 9 lista de noi comenzi.exe 13 2->9         started        13 wuapihost.exe 2->13         started        signatures3 process4 dnsIp5 38 cdn.discordapp.com 162.159.135.233, 443, 49731 CLOUDFLARENETUS United States 9->38 56 Writes to foreign memory regions 9->56 58 Allocates memory in foreign processes 9->58 60 Creates a thread in another existing process (thread injection) 9->60 62 Injects a PE file into a foreign processes 9->62 15 ieinstal.exe 9->15         started        signatures6 process7 signatures8 64 Modifies the context of a thread in another process (thread injection) 15->64 66 Maps a DLL or memory area into another process 15->66 68 Sample uses process hollowing technique 15->68 70 Queues an APC in another process (thread injection) 15->70 18 explorer.exe 3 15->18 injected process9 process10 20 colorcpl.exe 1 17 18->20         started        24 ieinstal.exe 18->24         started        26 ieinstal.exe 18->26         started        file11 28 C:\Users\user\AppData\...\8LOlogrv.ini, data 20->28 dropped 30 C:\Users\user\AppData\...\8LOlogri.ini, data 20->30 dropped 48 Detected FormBook malware 20->48 50 Tries to steal Mail credentials (via file access) 20->50 52 Tries to harvest and steal browser information (history, passwords, etc) 20->52 54 3 other signatures 20->54 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ee68069c79304ab2bc383e02c7d9f07ecdc9f91e9680afe381c72715225a89e/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 11:50:21 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f3tia2ohsmckwk6dqpqcy7m7a7wnzh4r5fuav7rydrzhcurfvcpa._file
Verdict:
malicious
Similar samples:
01563eeff9cd4cb84253c2c9bc40762d118780ab89c6c7b82ce9c9cf0a56a818
Formbook
017f433a49afcc765c5a5e7f39de6251fbe37d9c98f7d86f1abcefb1a9f559bc
Formbook
86d0178097eebb5010e24650ce79f80f19567ad2872f0f0b7325761a01cf67f5
Formbook
8afd54f2ed0af6d9593b0985cec1604748ca753900859fe4ee225d21b574e55e
Formbook
91ff383b66f03166257bbf629acfab862c2269e04b76bc49714520a5709e5e72
Formbook
be29f9be4b998a7893c2c182c972406067eaf913364484a1fa824133d71ef54f
Formbook
c5ccddfa0f7ee807513279b0195460cd48f3b36f2154c93ff3945fe30c647dde
Formbook
da63e8bb36574c655d7d306574afbc4a67396b12cf8553b1149e0ac8560dc313
Formbook
e95f01bbde0fbd70670b820b972768e7fc5f23509495c805ddbc3271030f443c
Formbook
f4cbb077c89f62bb6542489c882b324e8e2880dc3970e2540e61d1d25fff157a
Formbook
+ 5'435 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/200728-2p6wtzg4sj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Modifies system certificate store
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Adds Run key to start application
Adds Run key to start application
Reads user/profile data of web browsers
Reads user/profile data of web browsers
Adds policy Run key to start application
Adds policy Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ee68069c79304ab2bc383e02c7d9f07ecdc9f91e9680afe381c72715225a89e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 2ee68069c79304ab2bc383e02c7d9f07ecdc9f91e9680afe381c72715225a89e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/34042/

Comments