MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67da8a06938ef9c410525c901be8256cd02a9643d67a61f0f8d49c79fcfc6ef5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67da8a06938ef9c410525c901be8256cd02a9643d67a61f0f8d49c79fcfc6ef5
SHA3-384 hash: 2064a6eea18e293b68b0a560cffb5f844a78d9f8c3fae6ded629fcb5473a828826032b49a7549b6d4f7321c05138e25e
SHA1 hash: 91e8fd92e3fab8b9f03f729ab0cfdd2b482286ee
MD5 hash: dfd2ef8c9e44c35b671d0cadca096f15
humanhash: bakerloo-don-batman-gee
File name:quote107.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'213'440 bytes
First seen:2020-08-04 11:25:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:Kx8LW8H2GBuJVJZg2JUXao2q5/f0hRJKIYTgwmhNHhZL5aVFi2:KJ8Xu1ZJJ6T2W/8hRJKIYTgwmhNHhZLM
Threatray 5'419 similar samples on MalwareBazaar
TLSH 56457C82F1448911C95A0F36CD67DAB483777D6AFF4797067084FA2B78E3183AE216C6
Reporter abuse_ch
Tags:Endurance exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: Daniel Chen < server@hinet.net>
Subject: Immediate quote required
Attachment: quote107.zip (contains "quote107.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38589/
Detection(s):
SecuriteInfo.com.Backdoor.MSIL.Bladabindi.15098.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/409149
Signature
Benign windows process drops PE files
Detected FormBook malware
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 256824 Sample: quote107.exe Startdate: 04/08/2020 Architecture: WINDOWS Score: 100 63 Malicious sample detected (through community Yara rule) 2->63 65 Yara detected AntiVM_3 2->65 67 Yara detected FormBook 2->67 69 5 other signatures 2->69 10 quote107.exe 3 2->10         started        process3 file4 47 C:\Users\user\AppData\...\quote107.exe.log, ASCII 10->47 dropped 87 Tries to detect virtualization through RDTSC time measurements 10->87 14 quote107.exe 10->14         started        signatures5 process6 signatures7 89 Modifies the context of a thread in another process (thread injection) 14->89 91 Maps a DLL or memory area into another process 14->91 93 Sample uses process hollowing technique 14->93 95 Queues an APC in another process (thread injection) 14->95 17 explorer.exe 4 6 14->17 injected process8 dnsIp9 49 www.tvdaum.com 203.170.80.253, 49751, 80 DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU Australia 17->49 51 www.spartaving.com 17->51 53 www.jipiao12580.com 17->53 41 C:\Users\user\AppData\Local\...\configu4n.exe, PE32 17->41 dropped 71 System process connects to network (likely due to code injection or exploit) 17->71 73 Benign windows process drops PE files 17->73 22 rundll32.exe 1 17 17->22         started        26 configu4n.exe 3 17->26         started        28 configu4n.exe 2 17->28         started        30 5 other processes 17->30 file10 signatures11 process12 file13 43 C:\Users\user\AppData\...\9P8logrv.ini, data 22->43 dropped 45 C:\Users\user\AppData\...\9P8logri.ini, data 22->45 dropped 75 Detected FormBook malware 22->75 77 Tries to steal Mail credentials (via file access) 22->77 79 Tries to harvest and steal browser information (history, passwords, etc) 22->79 85 2 other signatures 22->85 32 cmd.exe 1 22->32         started        81 Injects a PE file into a foreign processes 26->81 35 configu4n.exe 26->35         started        37 configu4n.exe 28->37         started        83 Tries to detect virtualization through RDTSC time measurements 30->83 signatures14 process15 signatures16 55 Tries to detect virtualization through RDTSC time measurements 32->55 39 conhost.exe 32->39         started        57 Modifies the context of a thread in another process (thread injection) 37->57 59 Maps a DLL or memory area into another process 37->59 61 Sample uses process hollowing technique 37->61 process17
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/67da8a06938ef9c410525c901be8256cd02a9643d67a61f0f8d49c79fcfc6ef5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:27:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m7niubutr344iecslsibx2bfnticvfsd2z5gd4hy2soht7h4n32q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
12682b2e7f9831339ab54913afd5fbbe42fb11af2c15d92f53776e5d45e50e94
FormBook
420c2572fe66b34a3e994b43ec3d35a60559c2b011c02c038854a99034a9ca2f
FormBook
47e2cdade33723e82c06a0411695ff32f874ee73024f658cf8c00592dff729a8
FormBook
52487a544f6987349f5cab38dd1cfdd2aac0ac6efff911fc171a1ae844bd9f87
FormBook
6830866e2d41b970c95172f9a156522c72cfd238f846c02c19827b2100fc5deb
FormBook
a733deff759ea8ed7bcb941789e3458cd51b4bb355b66c34a08e3c790ea5f688
FormBook
d13e6324eeeba019e6893f6420259df2c840899305447530c99067cadb426cc8
FormBook
d670baae02ac0598fa3964c26f61b1ce8aad0b50e48d4903e37b3cd1be720b6d
FormBook
df55898a2e3ad76e9ca691d178e15d2c499f391be7ed604a10ea7084e02d9446
FormBook
fa2fea7b2c7e6d02c40890b178133c0c21e6e1182c170c09de4550e85c98e67f
FormBook
+ 5'409 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat persistence spyware trojan stealer family:formbook evasion
Link:
https://tria.ge/reports/200804-fygm9eqsgj/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
System policy modification
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Reads user/profile data of web browsers
Deletes itself
Adds policy Run key to start application
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/67da8a06938ef9c410525c901be8256cd02a9643d67a61f0f8d49c79fcfc6ef5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

d45fa6c88cfeddf93d961de7b819529c

FormBook

Executable exe 67da8a06938ef9c410525c901be8256cd02a9643d67a61f0f8d49c79fcfc6ef5

(this sample)

  
Dropped by
MD5 d45fa6c88cfeddf93d961de7b819529c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38589/

Comments