MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e
SHA3-384 hash: e9e8d2625ea5bcd5c145a48ecfccd2a772774dd10d294611251c9e3b7e8e22480c03c58477878bfde0d061d8507e4063
SHA1 hash: dace8b92ed4181ea1959aa42edb94d11e71fe47a
MD5 hash: da64fb838cf3e807f83bedc61659574a
humanhash: sierra-bulldog-chicken-november
File name:quote108.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'326'592 bytes
First seen:2020-08-05 09:12:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 24576:ICLeq+KHV71kzgTctpwKpwYVRPJFS6K5lJziDb4OyPCYkFWYz:d/+KpegTctpRppVRK6+fIyPrkFWYz
Threatray 5'299 similar samples on MalwareBazaar
TLSH 9E55D0917940DF9EC86E0F3034272840E7E2AD1A5D55F64FACC675FC1BB7A87481AA0E
Reporter abuse_ch
Tags:Endurance exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: Daniel Chen <server@hinet.net>
Subject: Immediate quote required
Attachment: quote108.zip (contains "quote108.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39313/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/410759
Signature
Allocates memory in foreign processes
Benign windows process drops PE files
Detected FormBook malware
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 257692 Sample: quote108.exe Startdate: 05/08/2020 Architecture: WINDOWS Score: 100 53 www.casavillaesperanza.com 2->53 61 Malicious sample detected (through community Yara rule) 2->61 63 Yara detected AntiVM_3 2->63 65 Yara detected FormBook 2->65 67 3 other signatures 2->67 11 quote108.exe 3 2->11         started        signatures3 process4 signatures5 87 Tries to detect virtualization through RDTSC time measurements 11->87 89 Injects a PE file into a foreign processes 11->89 14 quote108.exe 11->14         started        process6 signatures7 91 Modifies the context of a thread in another process (thread injection) 14->91 93 Maps a DLL or memory area into another process 14->93 95 Sample uses process hollowing technique 14->95 97 Queues an APC in another process (thread injection) 14->97 17 explorer.exe 4 6 14->17 injected process8 dnsIp9 47 www.godhep.com 162.0.224.62, 49748, 49751, 49752 NAMECHEAP-NETUS Canada 17->47 49 www.matthewjgardner.com 17->49 51 2 other IPs or domains 17->51 41 C:\Users\user\AppData\Local\...\update7n4.exe, PE32 17->41 dropped 69 System process connects to network (likely due to code injection or exploit) 17->69 71 Benign windows process drops PE files 17->71 22 cmd.exe 1 17 17->22         started        26 update7n4.exe 3 17->26         started        28 update7n4.exe 2 17->28         started        file10 signatures11 process12 file13 43 C:\Users\user\AppData\...\7N9logrv.ini, data 22->43 dropped 45 C:\Users\user\AppData\...\7N9logri.ini, data 22->45 dropped 73 Detected FormBook malware 22->73 75 Tries to steal Mail credentials (via file access) 22->75 77 Tries to harvest and steal browser information (history, passwords, etc) 22->77 85 3 other signatures 22->85 30 cmd.exe 1 22->30         started        79 Injects a PE file into a foreign processes 26->79 32 update7n4.exe 26->32         started        81 Writes to foreign memory regions 28->81 83 Allocates memory in foreign processes 28->83 35 update7n4.exe 28->35         started        37 update7n4.exe 28->37         started        signatures14 process15 signatures16 39 conhost.exe 30->39         started        55 Modifies the context of a thread in another process (thread injection) 32->55 57 Maps a DLL or memory area into another process 32->57 59 Sample uses process hollowing technique 32->59 process17
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:08:38 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6f6o5eljfrtrlevkiup6uhegbehz75qt36wyjjph6f6br7uttypa._file
Verdict:
malicious
Similar samples:
0e596eee578e5cc009d172a7dbae0cf150bbf925360389b9961e67c60ab8f3a2
FormBook
23f5c4c38dc1ab5c57de98087bdc5ed23a2a0b123293526eb496dae8e9311e2d
FormBook
2bccd7c0c084c310cc99b76682f6747baebaec683536a1ec3a8210b55daa327a
FormBook
327bc1ad9fc793811e5da6cb3553b7dca05c8a48d8060fc94015339ee805851d
FormBook
474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f
FormBook
4a6187dd467be22cbd3eab6807d368c37535c488af22442498423da8124f35fa
FormBook
5d23715d3724a6a10e1af754d9fd8209a399164c65d020eceaa8aa1ff93879be
FormBook
8288e9e21f28be24c2d3839e26c3c726dc90e9955a8506816fb498044f9846b6
FormBook
a3146b5cf5e3e45e07943cd02d6b2758acce9213ffb3b33dc4f0c098d54dd58b
FormBook
b91d1df833c959a0c941ea92dae9d30f23cb4825ae33594da4eafc758a8de10f
FormBook
+ 5'289 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200805-jh1vvqrerx/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious behavior: MapViewOfSection
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 4d58860b5ec12cfdf4e20a5aad49b6c607e5f6a19f0a9b6514a2f081d0cbce42

FormBook

Executable exe f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e

(this sample)

  
Dropped by
MD5 642fdd4f91b76481b577dc03aba6150f
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/39313/
  
Dropped by
SHA256 4d58860b5ec12cfdf4e20a5aad49b6c607e5f6a19f0a9b6514a2f081d0cbce42

Comments