MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3146b5cf5e3e45e07943cd02d6b2758acce9213ffb3b33dc4f0c098d54dd58b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3146b5cf5e3e45e07943cd02d6b2758acce9213ffb3b33dc4f0c098d54dd58b
SHA3-384 hash: 97704efec661108a8f13f80335541d0a3dbab915bbfd9b898cc17ee12ddf0790440ba33d17757cf638fb6dae8bec4de2
SHA1 hash: d01f97c55345389014a2eb7aa90a3c9b29cf8923
MD5 hash: ef98e61b0caace13d0a0a660bca98338
humanhash: connecticut-fish-carolina-oxygen
File name:quote101.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:717'824 bytes
First seen:2020-07-30 07:05:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ral7bDWSd5ak++zHJ5vBE+vn00s57ggc4u8CYuKBpYQI2cThdreEpvJ1wS:Sn45+zp5qIe5EgYtQI2cThdvHh
Threatray 5'323 similar samples on MalwareBazaar
TLSH 00E4BF9272009BADC91F5F71D8320C1056A2AD7B9B1AF38B7CC235991EFB2E66536413
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server.megatroncorp.community
Sending IP: 162.241.205.158
From: daniel.chen <server@blueinnovations.solutions>
Subject: Immediate quote required
Attachment: quote101.zip (contains "quote101.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35317/
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.3867.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/403222
Signature
Benign windows process drops PE files
Detected FormBook malware
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 253840 Sample: quote101.exe Startdate: 30/07/2020 Architecture: WINDOWS Score: 100 45 www.jb-o8y.com 2->45 47 g.msn.com 2->47 55 Malicious sample detected (through community Yara rule) 2->55 57 Yara detected AntiVM_3 2->57 59 Yara detected FormBook 2->59 61 6 other signatures 2->61 11 quote101.exe 3 2->11         started        signatures3 process4 file5 43 C:\Users\user\AppData\...\quote101.exe.log, ASCII 11->43 dropped 77 Tries to detect virtualization through RDTSC time measurements 11->77 79 Injects a PE file into a foreign processes 11->79 15 quote101.exe 11->15         started        signatures6 process7 signatures8 81 Modifies the context of a thread in another process (thread injection) 15->81 83 Maps a DLL or memory area into another process 15->83 85 Sample uses process hollowing technique 15->85 87 Queues an APC in another process (thread injection) 15->87 18 explorer.exe 4 6 15->18 injected process9 dnsIp10 49 www.crazyedu.com 150.109.151.204, 49744, 80 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN Singapore 18->49 51 www.thsavingsbankohio.com 18->51 53 www.fincasyvecinos.com 18->53 37 C:\Users\user\AppData\...\q0hxv44hf4.exe, PE32 18->37 dropped 63 System process connects to network (likely due to code injection or exploit) 18->63 65 Benign windows process drops PE files 18->65 23 svchost.exe 18->23         started        27 q0hxv44hf4.exe 18->27         started        file11 signatures12 process13 file14 39 C:\Users\user\AppData\...\11Nlogrv.ini, data 23->39 dropped 41 C:\Users\user\AppData\...\11Nlogri.ini, data 23->41 dropped 67 Detected FormBook malware 23->67 69 Tries to steal Mail credentials (via file access) 23->69 71 Tries to harvest and steal browser information (history, passwords, etc) 23->71 75 3 other signatures 23->75 29 cmd.exe 23->29         started        73 Injects a PE file into a foreign processes 27->73 31 q0hxv44hf4.exe 27->31         started        33 q0hxv44hf4.exe 27->33         started        signatures15 process16 process17 35 conhost.exe 29->35         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a3146b5cf5e3e45e07943cd02d6b2758acce9213ffb3b33dc4f0c098d54dd58b/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 07:07:09 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=umkgwxhv4psf4b4uhtic22zhlcwm5eqt76z3gpoe6dajrvkn2wfq._file
Verdict:
malicious
Similar samples:
0e596eee578e5cc009d172a7dbae0cf150bbf925360389b9961e67c60ab8f3a2
FormBook
23f5c4c38dc1ab5c57de98087bdc5ed23a2a0b123293526eb496dae8e9311e2d
FormBook
2bccd7c0c084c310cc99b76682f6747baebaec683536a1ec3a8210b55daa327a
FormBook
327bc1ad9fc793811e5da6cb3553b7dca05c8a48d8060fc94015339ee805851d
FormBook
474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f
FormBook
4a6187dd467be22cbd3eab6807d368c37535c488af22442498423da8124f35fa
FormBook
5d23715d3724a6a10e1af754d9fd8209a399164c65d020eceaa8aa1ff93879be
FormBook
8288e9e21f28be24c2d3839e26c3c726dc90e9955a8506816fb498044f9846b6
FormBook
b91d1df833c959a0c941ea92dae9d30f23cb4825ae33594da4eafc758a8de10f
FormBook
f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e
FormBook
+ 5'313 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200730-8z6g6ser4n/
Behaviour
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3146b5cf5e3e45e07943cd02d6b2758acce9213ffb3b33dc4f0c098d54dd58b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 8dab7f9bcfedbf993df9dafb17bf3ba67149907512daf607d7fcb7d2d7d42916

FormBook

Executable exe a3146b5cf5e3e45e07943cd02d6b2758acce9213ffb3b33dc4f0c098d54dd58b

(this sample)

  
Dropped by
MD5 e537e192981a7aa6e722040c45a43bae
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/35317/
  
Dropped by
SHA256 8dab7f9bcfedbf993df9dafb17bf3ba67149907512daf607d7fcb7d2d7d42916

Comments