MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb1972afed7256922af8f7471f5e9e35f48ae24e302c66c0b1621c7deb499b3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	bb1972afed7256922af8f7471f5e9e35f48ae24e302c66c0b1621c7deb499b3e
SHA3-384 hash:	e378d9375365363832f1bce7acce14a8ba4fb3056fbba2ac0b52f60d7f9e33af78fd03fcf1d7b411273cf320b2881b96
SHA1 hash:	0ab716ebd4ec22251fdc094e247b63af5e511d85
MD5 hash:	92a3a9037ae2b89916b9d6e8aaa6252f
humanhash:	ceiling-mexico-item-quebec
File name:	Item list.xlsm
Download:	download sample
Signature	Formbook Create hunting rule
File size:	120'392 bytes
First seen:	2020-08-11 11:40:06 UTC
Last seen:	2020-08-11 13:19:27 UTC
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	3072:IeYVepuW3riUK34o/6AIFjRSa7XFlS+6cg2TgXeSU1c:ZqA9rizojjVlUcBuL
TLSH	EDC3126DBE84B801CA4EBAF1D33D85CC6475A301D415E80BA7E5B03854C3E6C2DA7A6E
Reporter	abuse_ch
Tags:	FormBook xlsm

abuse_ch

Malspam distributing Formbook:

HELO: thinkitweb.gr
Sending IP: 212.129.50.130
From: Penelope Alvarez <toula@elemantoniou.gr>
Subject: Re: Product request from Medigas SRL2
Attachment: Item list.xlsm

FormBook payload URL:
http://scscdvddvbf.cf/temp/kerhdgf.exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Heur.Macro.Generic.h.73777f0.28071.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Creating a file

Creating a file in the %temp% directory

Launching a process

Launching cmd.exe command interpreter

Deleting a recently created file

Setting browser functions hooks

Sending an HTTP GET request

Unauthorized injection to a recently created process by context flags manipulation

Creating a process from a recently created file

Unauthorized injection to a system process

Unauthorized injection to a browser process

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/418638

Signature

Creates HTML files with .exe extension (expired dropper behavior)

Document exploit detected (creates forbidden files)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb1972afed7256922af8f7471f5e9e35f48ae24e302c66c0b1621c7deb499b3e/

Threat name:

Document-Word.Trojan.Bluteal

Status:

Malicious

First seen:

2020-08-11 11:41:05 UTC

AV detection:

17 of 29 (58.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xmmxfl7nojljekxy65dr6xu6gx2ivysogawgnqfrmioh322jtm7a._file

Result

Malware family:

formbook

Score:

10/10

Tags:

rat evasion trojan spyware stealer family:formbook persistence

Link:

https://tria.ge/reports/200811-wd7yd74hbj/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System policy modification

Office loads VBA resources, possible macro or embedded object present

Drops file in Program Files directory

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Loads dropped DLL

Reads user/profile data of web browsers

Adds policy Run key to start application

Executes dropped EXE

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.flekcht.com/sku/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bb1972afed7256922af8f7471f5e9e35f48ae24e302c66c0b1621c7deb499b3e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.