MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc84debcfc3e30a4b682bb53e028acb0a75d56607ab25b2418797f65a7e6efb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc84debcfc3e30a4b682bb53e028acb0a75d56607ab25b2418797f65a7e6efb7
SHA3-384 hash: a24907bebfbb0b51c613251e13ab3cb72d35212980245af02eb282f4d922850e6267851af6f1fde0e45feee90a5e3150
SHA1 hash: 8a226895eacbcd3103c3de1b556a3c6900b1edef
MD5 hash: 339e21f5891cb585710cd86ca799fdba
humanhash: london-arizona-lithium-illinois
File name:TOYO-M’s General Conditions of Purchase.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:856'064 bytes
First seen:2020-08-04 10:14:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:b3Ou0HcPgYxmOE+2Do4pPeRH89fx/jPhVTq/+rMHvniNp12mDVjUR:iu5IYxPeVZlH1VTQqMHe3V
Threatray 5'271 similar samples on MalwareBazaar
TLSH CC05AEC5F1409A5DD81A4D3B8D324C914B33AC6BEF06D207349DB6996BBB1C66E24F83
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

From: gomez reham <gomez-reham@toyo-eng.com>
Reply-To: procurement@toyo-eng.com
Subject: RE: TOYO ENGINEERING FINAL REMINDER [PR742 BIO-MEG] AYBF001 Hot Oil Heater / RFQ / Toyo Engineering & Construction Sdn. Bhd
Attachment: TOYO-M’s General Conditions of Purchase.exe.iso (contains "TOYO-M’s General Conditions of Purchase.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38450/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/409261
Signature
Benign windows process drops PE files
Detected FormBook malware
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses netstat to query active network connections and open ports
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 256913 Sample: TOYO-M#U00e2s General Condi... Startdate: 04/08/2020 Architecture: WINDOWS Score: 100 57 Malicious sample detected (through community Yara rule) 2->57 59 Yara detected AntiVM_3 2->59 61 Yara detected FormBook 2->61 63 7 other signatures 2->63 10 TOYO-M#U00e2s General Conditions of Purchase.exe 1 2->10         started        process3 file4 49 TOYO-M#U00e2s Gene...of Purchase.exe.log, ASCII 10->49 dropped 83 Injects a PE file into a foreign processes 10->83 14 TOYO-M#U00e2s General Conditions of Purchase.exe 10->14         started        17 TOYO-M#U00e2s General Conditions of Purchase.exe 10->17         started        signatures5 process6 signatures7 85 Modifies the context of a thread in another process (thread injection) 14->85 87 Maps a DLL or memory area into another process 14->87 89 Queues an APC in another process (thread injection) 14->89 19 explorer.exe 4 6 14->19 injected process8 dnsIp9 51 www.patlod.com 63.250.47.235, 49743, 80 NAMECHEAP-NETUS United States 19->51 53 www.suzhoucheckmate.com 19->53 55 www.950vpk.info 19->55 43 C:\Users\user\AppData\...\0jo0gpxw0vpl.exe, PE32 19->43 dropped 69 System process connects to network (likely due to code injection or exploit) 19->69 71 Benign windows process drops PE files 19->71 24 NETSTAT.EXE 1 17 19->24         started        28 0jo0gpxw0vpl.exe 1 19->28         started        30 0jo0gpxw0vpl.exe 19->30         started        32 colorcpl.exe 19->32         started        file10 signatures11 process12 file13 45 C:\Users\user\AppData\...\K62logrv.ini, data 24->45 dropped 47 C:\Users\user\AppData\...\K62logri.ini, data 24->47 dropped 73 Detected FormBook malware 24->73 75 Tries to steal Mail credentials (via file access) 24->75 77 Tries to harvest and steal browser information (history, passwords, etc) 24->77 81 3 other signatures 24->81 34 cmd.exe 1 24->34         started        79 Injects a PE file into a foreign processes 28->79 36 0jo0gpxw0vpl.exe 28->36         started        39 0jo0gpxw0vpl.exe 28->39         started        signatures14 process15 signatures16 41 conhost.exe 34->41         started        65 Modifies the context of a thread in another process (thread injection) 36->65 67 Maps a DLL or memory area into another process 36->67 process17
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cc84debcfc3e30a4b682bb53e028acb0a75d56607ab25b2418797f65a7e6efb7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 10:16:08 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zscn5ph4hyykjnucxnj6akfmwctv2vtapkzfwjaypf7wlj7g563q._file
Verdict:
malicious
Similar samples:
0cd37496a09d3516103a2ba627f8c4bc9ba2eb99b0618d719a3fa9d708b9862d
FormBook
1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a
FormBook
30efd997c49aae97766539c72d72529b06f1e8522ea84e71758cde4ed1846921
FormBook
3224b351afdfb9166bf37fde75a48e9d3212916a6584634600f90971ba3883ed
FormBook
4a21cad0d588267ebde8f8112e9d85bf355c77434beda6436cd9403a0a787c0d
FormBook
52e01cac4f5319a7d1177aae77861b4ad8f77b26581d089e948344d0e608b80b
FormBook
8697eb117ba4ca2b18a9a7bbdcbd201cc062e2e79ccbc9d8ea785baf5b868657
FormBook
9d545cae8b73e11800aaf794b2919bb8972511e4e217eaf1a51c3f38c17bb412
FormBook
bd3afdd3cda53eebbebcc99b946ff7eb2f972fcf1c5a3a11ffcf633a46f1b853
FormBook
fc95c84eb428f263fef3220d512a2f602570f2acb41a46114244c30af48fd51b
FormBook
+ 5'261 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat evasion trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200804-wy1123akwj/
Behaviour
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Deletes itself
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc84debcfc3e30a4b682bb53e028acb0a75d56607ab25b2418797f65a7e6efb7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso f0fcfb06093cb25bc222e54065620b24f582b5865cb7a6c9e5a238fe8743340e

FormBook

Executable exe cc84debcfc3e30a4b682bb53e028acb0a75d56607ab25b2418797f65a7e6efb7

(this sample)

  
Dropped by
MD5 87a4d35c6c735302ed84dc0ba785584a
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38450/
  
Dropped by
SHA256 f0fcfb06093cb25bc222e54065620b24f582b5865cb7a6c9e5a238fe8743340e

Comments