MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9b141757defd483a6ff17438e86be87e0c1e5bc3d943c15989d84f577def797. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9b141757defd483a6ff17438e86be87e0c1e5bc3d943c15989d84f577def797
SHA3-384 hash: 66a988283e00e583854b50ab56ef204479c6d01b7a8cb5a31130ac4759f61746e72ad87bed759b0d425821c90ab1bc49
SHA1 hash: e00a9c847419d53e21f6edb25d70a79bdf30723f
MD5 hash: 0552dc2eb77ff766b362f1cdef722a14
humanhash: michigan-eighteen-wisconsin-rugby
File name:нова поръчка.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:491'008 bytes
First seen:2020-08-13 11:19:39 UTC
Last seen:2020-08-13 12:24:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:FBqRTt/dyW2AFdrYrjuy84Cx2nfVTusVvlJUIABQVyUaaq7veLhIMizTC/Ik6prS:J+aZ9nfV1rJU54yUaagveLVX6pre/Z
Threatray 2'260 similar samples on MalwareBazaar
TLSH F3A4CF6A22F4DA09C03BF7BD92641142B3E77C4A24A1C71A9DDC18D90D35BD24B63DFA
Reporter abuse_ch
Tags:BGR exe FormBook geo


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Skountzos Daria <parts@titanmachinery.ua>
Subject: Re: Re: покупка на нова поръчка
Attachment: нова поръчка.zip (contains "нова поръчка.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45127/
Detection(s):
SecuriteInfo.com.FileRepMalware.31686.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/426010
Signature
Benign windows process drops PE files
Detected FormBook malware
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses ipconfig to lookup or modify the Windows network settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 265633 Sample: #U043d#U043e#U0432#U0430 #U... Startdate: 14/08/2020 Architecture: WINDOWS Score: 100 54 www.xiaoxiong365.com 2->54 60 Malicious sample detected (through community Yara rule) 2->60 62 Sigma detected: Scheduled temp file as task from temp location 2->62 64 Yara detected AntiVM_3 2->64 66 5 other signatures 2->66 11 #U043d#U043e#U0432#U0430 #U043f#U043e#U0440#U044a#U0447#U043a#U0430.exe 7 2->11         started        signatures3 process4 file5 46 C:\Users\user\AppData\Local\...\tmp6E13.tmp, XML 11->46 dropped 48 C:\Users\user\AppData\Roaming\sLYatF.exe, PE32 11->48 dropped 14 RegSvcs.exe 11->14         started        17 RegSvcs.exe 11->17         started        19 schtasks.exe 1 11->19         started        process6 signatures7 80 Modifies the context of a thread in another process (thread injection) 14->80 82 Maps a DLL or memory area into another process 14->82 84 Sample uses process hollowing technique 14->84 86 Queues an APC in another process (thread injection) 14->86 21 explorer.exe 4 6 14->21 injected 88 Tries to detect virtualization through RDTSC time measurements 17->88 26 conhost.exe 19->26         started        process8 dnsIp9 56 www.qv85.com 104.31.69.137, 49744, 80 CLOUDFLARENETUS United States 21->56 58 www.jatinangorcity.com 21->58 44 C:\Users\user\AppData\...\4h74anh4nhs.exe, PE32 21->44 dropped 68 System process connects to network (likely due to code injection or exploit) 21->68 70 Benign windows process drops PE files 21->70 28 ipconfig.exe 1 17 21->28         started        32 4h74anh4nhs.exe 2 21->32         started        34 4h74anh4nhs.exe 1 21->34         started        file10 signatures11 process12 file13 50 C:\Users\user\AppData\...\333logrv.ini, data 28->50 dropped 52 C:\Users\user\AppData\...\333logri.ini, data 28->52 dropped 72 Detected FormBook malware 28->72 74 Tries to steal Mail credentials (via file access) 28->74 76 Tries to harvest and steal browser information (history, passwords, etc) 28->76 78 3 other signatures 28->78 36 cmd.exe 1 28->36         started        38 conhost.exe 32->38         started        40 conhost.exe 34->40         started        signatures14 process15 process16 42 conhost.exe 36->42         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c9b141757defd483a6ff17438e86be87e0c1e5bc3d943c15989d84f577def797/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 11:21:09 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zgyuc5l557kihjx7c5by5bv6q7qmdzn4hwkdyfmytwcpk56666lq._file
Verdict:
malicious
Similar samples:
0687d57f87a19e9860bc0f991a91ea9af31f8625dd15d191f4fac7e73520b49b
Formbook
1adb1e77313a4404c1133c255cece52584f329eeb223d6567beb97d9754125ce
Formbook
61f179ab9d877a4089f3a2e21db9d62537a9181fe6f58ba81a9eb2b0c45ac3a5
Formbook
70fce2b9eb9360b8733c9b77032bb566399d7ed9c2fb99b0cf2c823e93485bd9
Formbook
c78121bbdd5fd02c92cca52055650fdd918a18da261844b609d0eb65a372aa52
Formbook
d6cfa16240c572c1d310d0e3f9a3a48254103dbfdaf47d08b31bd255a6022d50
Formbook
e33cd4567a22274d37c8dd41b7ac5300bc0f5f3ded012e299451d588ee412ca8
Formbook
e6249562be8d8ab7fe78437565bc91c6b2aff27365f3fa33272c0f700c683f62
Formbook
f08055b66d4e8209560d1322c12c553b466ec737196e597ae00694e8035c25d2
Formbook
f959039896cdd9c4add867b06af7d100629377c66ef7fb0fd4aeba48f9a9593e
Formbook
+ 2'250 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200813-d2mlgycszj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.fex-tracks.com/kvsz/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/c9b141757defd483a6ff17438e86be87e0c1e5bc3d943c15989d84f577def797

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 18b4cd72864cf3ac6bd169fadfa6db171d499e5fbbd5795ea3625d01d17d3f1d

Formbook

Executable exe c9b141757defd483a6ff17438e86be87e0c1e5bc3d943c15989d84f577def797

(this sample)

  
Dropped by
MD5 277df4943e7cae4b07b7a60e6c27bf36
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 18b4cd72864cf3ac6bd169fadfa6db171d499e5fbbd5795ea3625d01d17d3f1d
Cape
Cape
https://www.capesandbox.com/analysis/45127/

Comments