MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b29a4e94a19a7a488a37054b74c86aa6e43830bd10c675ddbe80274aead159cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	b29a4e94a19a7a488a37054b74c86aa6e43830bd10c675ddbe80274aead159cc
SHA3-384 hash:	7937be5574849aac8d7495cfff17af25c985160d052d397e421764ac70e21782b6959e634991d44a5542117ebb3341f3
SHA1 hash:	34753f0f451ba6dc44623e7050d528a05b79199a
MD5 hash:	c2dd16a774c71c8807e3b7da7018d356
humanhash:	xray-march-dakota-yellow
File name:	MEISE_GRP_LIST.xlsm
Download:	download sample
Signature	Formbook Create hunting rule
File size:	120'363 bytes
First seen:	2020-07-28 13:59:11 UTC
Last seen:	2020-07-28 15:02:27 UTC
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	3072:veYVepuW3riUK34o/6AIFjRSa7XFlS+6cg2TgXeSU132:WqA9rizojjVlUcBuk2
TLSH	35C312AD7B84A901CE497AF1D33E85CC7435A305E855D80B53E5B03860C3E6D2EA7A6F
Reporter	abuse_ch
Tags:	FormBook xlsm

abuse_ch

Malspam distributing Formbook:

HELO: slot0.ilerpic.com
Sending IP: 104.168.176.234
From: jorgs@meise.com
Subject: MEDIZINTECHNIK SYSTEM REQUEST FOR QUOTATION 442439
Attachment: MEISE_GRP_LIST.xlsm

FormBook payload URL:
http://federict.ml/temp/lorfgt.exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Heur.Macro.Generic.h.864ba2f9.30205.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Creating a file

Creating a file in the %temp% directory

Launching a process

Launching cmd.exe command interpreter

Deleting a recently created file

Sending an HTTP GET request

Unauthorized injection to a recently created process by context flags manipulation

Creating a process from a recently created file

Unauthorized injection to a system process

Unauthorized injection to a browser process

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/400488

Signature

Antivirus detection for URL or domain

Creates HTML files with .exe extension (expired dropper behavior)

Document exploit detected (creates forbidden files)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b29a4e94a19a7a488a37054b74c86aa6e43830bd10c675ddbe80274aead159cc/

Threat name:

Win32.Trojan.Bluteal

Status:

Malicious

First seen:

2020-07-28 14:01:05 UTC

AV detection:

17 of 29 (58.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wkne5ffbtj5ercrxavfxjsdku3sdqmf5cddhlxn6qatuv2wrlhga._file

Result

Malware family:

formbook

Score:

10/10

Tags:

persistence spyware evasion trojan stealer family:formbook

Link:

https://tria.ge/reports/200728-zqsjdrs182/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Drops file in Program Files directory

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Adds Run key to start application

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Dropper

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/b29a4e94a19a7a488a37054b74c86aa6e43830bd10c675ddbe80274aead159cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.