MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75660f3d7f461c0559cabf3c76e0b44fad9ecb7fa85eb41a59b9c4192ef7f079. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75660f3d7f461c0559cabf3c76e0b44fad9ecb7fa85eb41a59b9c4192ef7f079
SHA3-384 hash: c4806beb890c78ab3a8580aa7c57c8264a14193ae3a3597f271787b4a82e31c8e3124f9fbc885350584221437a36d69f
SHA1 hash: e37c6be9b7aedc9a118ed80ef5be0417f6574cdc
MD5 hash: 6fff49839123c84674d547cec4508843
humanhash: alabama-louisiana-three-july
File name:bank copy.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:440'320 bytes
First seen:2020-08-06 04:43:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:cQQfqU0LkfJt/rZfX8kTn32XBarSEZ1FNH:zQiU0L8t/m232RSSEZfNH
Threatray 5'144 similar samples on MalwareBazaar
TLSH 7B94BF322288AFA5F03EE7BD9411160073F6E257D325F98E7EF940DA15A7F414B62A13
Reporter abuse_ch
Tags:Endurance exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: <sales@hinet.net>
Reply-To: roadtriip25@gmail.com
Subject: payment copy
Attachment: bank copy.gz (contains "bank copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/39986/
Detection(s):
SecuriteInfo.com.generic.ml.11902.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Launching cmd.exe command interpreter
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/412027
Signature
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 258254 Sample: bank copy.exe Startdate: 06/08/2020 Architecture: WINDOWS Score: 100 45 Malicious sample detected (through community Yara rule) 2->45 47 Sigma detected: Scheduled temp file as task from temp location 2->47 49 Yara detected AntiVM_3 2->49 51 7 other signatures 2->51 10 bank copy.exe 7 2->10         started        process3 file4 31 C:\Users\user\AppData\...behaviorgraphOxtmoogczt.exe, PE32 10->31 dropped 33 C:\Users\...behaviorgraphOxtmoogczt.exe:Zone.Identifier, ASCII 10->33 dropped 35 C:\Users\user\AppData\Local\...\tmpEEBD.tmp, XML 10->35 dropped 37 C:\Users\user\AppData\...\bank copy.exe.log, ASCII 10->37 dropped 59 Injects a PE file into a foreign processes 10->59 14 bank copy.exe 10->14         started        17 schtasks.exe 1 10->17         started        signatures5 process6 signatures7 61 Modifies the context of a thread in another process (thread injection) 14->61 63 Maps a DLL or memory area into another process 14->63 65 Sample uses process hollowing technique 14->65 67 Queues an APC in another process (thread injection) 14->67 19 explorer.exe 14->19 injected 22 conhost.exe 17->22         started        process8 dnsIp9 39 www.dineforwares.com 19->39 41 www.chatelguyon.net 19->41 43 3 other IPs or domains 19->43 24 cmmon32.exe 19->24         started        process10 signatures11 53 Modifies the context of a thread in another process (thread injection) 24->53 55 Maps a DLL or memory area into another process 24->55 57 Tries to detect virtualization through RDTSC time measurements 24->57 27 cmd.exe 1 24->27         started        process12 process13 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/75660f3d7f461c0559cabf3c76e0b44fad9ecb7fa85eb41a59b9c4192ef7f079/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 21:21:36 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ovta6pl7iyoakwokx46hnyfuj6wz5s37vbpligszxhcbslxx6b4q._file
Verdict:
malicious
Similar samples:
169ffbdfdecd290276b788ad335072af8b734d6181a7814481e2c4d4670ae093
Formbook
2a19861b5542b7a76129c027376c7c3902e38ab5d9914722af6b13eff1a28973
Formbook
39526c337781027d89c2b2bab838ffcf78648792c4547d83b4dba7c6a26c0885
Formbook
3ae1d5294542b34ed3a65d9b467d07a50146e561193e5923dd37dc3abcf81a57
Formbook
57e06d364efb34c1e83e57e1bebf4bfe796bfdebfede5d8ad6c9235b99954043
Formbook
74a4f01410127eb8a0cbfaaf9f8c60eb31bf8aad55599ba514d6ef02c9f660ff
Formbook
82e78f0c4c0c6064ba96cb12c0a4a9094b57a49540a053fe27f290f12e3afca1
Formbook
99018a172fc8ca8a7cb4435e90e2f162064516d1d1c09f9545ae11741cbc7804
Formbook
a10ce1d521b78847258cb7f037351b7af8c78391907bbfd78b513ea5345e37a5
Formbook
a85526e4a0f78afd83f57f2d084c0bd4b82846a06a0aef80c473905561dcfb60
Formbook
+ 5'134 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat evasion trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200806-1y6ac47t9j/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Deletes itself
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/75660f3d7f461c0559cabf3c76e0b44fad9ecb7fa85eb41a59b9c4192ef7f079

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz a85e6a10f9614e217b1cd5856e47d7058a72a939c20eee0ee332bff9139e3fe6

Formbook

Executable exe 75660f3d7f461c0559cabf3c76e0b44fad9ecb7fa85eb41a59b9c4192ef7f079

(this sample)

  
Dropped by
MD5 fce2981c34fca64fe1e82cba53a2142c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/39986/
  
Dropped by
SHA256 a85e6a10f9614e217b1cd5856e47d7058a72a939c20eee0ee332bff9139e3fe6

Comments