MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e0003e4f6d537153e60ac5129859a33b57b3b9a36b7d2be62273a6b3a8d5f3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e0003e4f6d537153e60ac5129859a33b57b3b9a36b7d2be62273a6b3a8d5f3f
SHA3-384 hash: 3ec42fb7398fa98f6652347be5898346b58929a5cc7d7685fc766f2d0d2b50e55f9f05f800a7b12016e0ec2643b6229f
SHA1 hash: 33c1ff8589faf0c2469a33131fcdffb01547dab0
MD5 hash: e2a5e6e8c1448dfcaf7ae95dff95ade9
humanhash: item-oranges-mango-seventeen
File name:URGENT-RFQ6532-JUNE2020.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:646'144 bytes
First seen:2020-06-11 06:13:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:HSuu5ExOV2h+V13m5bY+xyQvojokb/JpTA:HtyEwVyI13mxT+oJ
Threatray 5'517 similar samples on MalwareBazaar
TLSH F4D4050761BDE9DAF62E7DB1451617105AB06D622A36E243DC8F3DC9D43BB83CA406CB
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sungwon7.co
Sending IP: 111.90.158.36
From: Hari Khalsa <vonploetz@hannover-marketing.de>
Reply-To: david@kelichna.com
Subject: Re :KN95 MASK -SURGICAL MASK, NITRILE GLOVES URGENTLY NEEEDED
Attachment: URGENT-RFQ6532-JUNE2020.rar (contains "URGENT-RFQ6532-JUNE2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/8916/
Detection(s):
SecuriteInfo.com.LuheFihaA.9558.26308.UNOFFICIAL
Create hunting rule

Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/371486
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 237751 Sample: druS9vVaUK.exe Startdate: 11/06/2020 Architecture: WINDOWS Score: 100 48 Multi AV Scanner detection for domain / URL 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Multi AV Scanner detection for dropped file 2->52 54 6 other signatures 2->54 10 druS9vVaUK.exe 3 2->10         started        process3 file4 40 C:\Users\user\AppData\...\druS9vVaUK.exe.log, ASCII 10->40 dropped 68 Detected unpacking (changes PE section rights) 10->68 70 Detected unpacking (overwrites its own PE header) 10->70 72 Tries to detect virtualization through RDTSC time measurements 10->72 74 Injects a PE file into a foreign processes 10->74 14 druS9vVaUK.exe 10->14         started        signatures5 process6 signatures7 76 Modifies the context of a thread in another process (thread injection) 14->76 78 Maps a DLL or memory area into another process 14->78 80 Sample uses process hollowing technique 14->80 82 Queues an APC in another process (thread injection) 14->82 17 explorer.exe 4 6 14->17 injected process8 dnsIp9 42 www.isolb.net 209.99.64.55, 49711, 80 unknown United States 17->42 44 www.flycoz.com 63.250.42.84, 49712, 49713, 49714 unknown United States 17->44 46 www.qdbfqfphjidqgtbttnq.com 17->46 32 C:\Users\user\AppData\...\axh0nv7nt03do.exe, PE32 17->32 dropped 56 System process connects to network (likely due to code injection or exploit) 17->56 58 Benign windows process drops PE files 17->58 22 NETSTAT.EXE 1 18 17->22         started        26 axh0nv7nt03do.exe 2 17->26         started        file10 signatures11 process12 file13 34 C:\Users\user\AppData\...\940logrv.ini, data 22->34 dropped 36 C:\Users\user\AppData\...\940logri.ini, data 22->36 dropped 38 C:\Users\user\AppData\...\940logrf.ini, data 22->38 dropped 60 Detected FormBook malware 22->60 62 Tries to steal Mail credentials (via file access) 22->62 64 Tries to harvest and steal browser information (history, passwords, etc) 22->64 66 3 other signatures 22->66 28 cmd.exe 1 22->28         started        signatures14 process15 process16 30 conhost.exe 28->30         started       
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 03:45:45 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ryaahzhw2u3rkptavristbm2go2xwo42g235fptce45gwounl47q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
154d6b81bf4dcce3911f5c72f4790569e1cd91aee0040e7c1341f5286952bafe
Formbook
3026e3d087b09043925e42928fa0764af54475791f45f8ce97ce3f72b0a66e50
Formbook
50f8d8b5cbbad3f2a1d4a25b84553ba285f49318ab3dbb8d436b6709582997e8
Formbook
597022d4e4794fb02c89a43939d93d1b2b1140e798e355c2a53a8423f19514ad
Formbook
8319e58d392d571380931f7b06155190f296ce4f2af54af1f0fc2383f8569c4f
Formbook
8e3558d36802ba3f0da7c2b1188d5f12918959c2674e5421c2d15fad57d712e9
Formbook
968caaf20d88166fb2ea2774f772f36a4f070bd6d912f8a1c46c0ae4cd3a31a7
Formbook
a841d5eddb5208f4740c9d305151742f0a4c39b113e91d41414af98ff19c6c3d
Formbook
c0f75c29c7e6f1531ae8f5b9f3e1f6c1c11d0f6cc06a76d308cc5a7f4e7736ac
Formbook
cbd6e5626ae84385a9fc7a7eab1877be367ef0b69dc1c4a8de1f668ecb018ab2
Formbook
+ 5'507 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-6e1vxkrzjn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.flycoz.com/te/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 42bab315ee33a0494ac09f8dbce44822d9c6206069e02c7a6e71828a6b85e7c1

Formbook

Executable exe 8e0003e4f6d537153e60ac5129859a33b57b3b9a36b7d2be62273a6b3a8d5f3f

(this sample)

  
Dropped by
MD5 a07b556663154b42fa448ce48c212b35
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 42bab315ee33a0494ac09f8dbce44822d9c6206069e02c7a6e71828a6b85e7c1
Cape
Cape
https://www.capesandbox.com/analysis/8916/

Comments