MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0047270c26f603d132bc8e6a67894311356fe2d3c977aa287a09a8261f6b5690. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0047270c26f603d132bc8e6a67894311356fe2d3c977aa287a09a8261f6b5690
SHA3-384 hash: af53d84494444cfb034bc6bd3692ea2bfdc29aa3d6baf5e22d31f67c0d42c35c10735c7b26dcb879f3e012da0cbbc257
SHA1 hash: 607ec4ab698dffdd9b0546f3a030a88fdd6ce8b7
MD5 hash: cc034757c9d872b0a95e4a67967e50ac
humanhash: jupiter-summer-grey-freddie
File name:PO0932083943974.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:461'312 bytes
First seen:2020-07-21 07:39:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:2XjfDOnW3ZSyRw6TBQWK3hxqU0TfmSXhzPsWWQhNmyHGBmnHDipvp:6xSWyxp0qSJsW9hNtRw
Threatray 2'352 similar samples on MalwareBazaar
TLSH C6A44B70E7BA4AD5E3BA17BDD460004087B4BD0AA7E6E759DB90F4E91822751CB13F23
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.196
From: Michael <michael-cui@haixin-crafts.com>
Subject: PO0932083943974
Attachment: PO0932083943974.zip (contains "PO0932083943974.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29825/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Launching a process
Creating a file
Launching cmd.exe command interpreter
Sending an HTTP GET request
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/392772
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 248643 Sample: PO0932083943974.exe Startdate: 21/07/2020 Architecture: WINDOWS Score: 100 39 www.e-jie360.com 2->39 47 Malicious sample detected (through community Yara rule) 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Sigma detected: Steal Google chrome login data 2->51 53 2 other signatures 2->53 11 PO0932083943974.exe 5 2->11         started        signatures3 process4 file5 37 C:\Users\user\...\PO0932083943974.exe.log, ASCII 11->37 dropped 67 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->67 15 vbc.exe 11->15         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 15->69 71 Maps a DLL or memory area into another process 15->71 73 Sample uses process hollowing technique 15->73 75 2 other signatures 15->75 18 explorer.exe 1 15->18 injected process9 dnsIp10 41 whackajudge.com 162.241.225.243, 49724, 49725, 80 UNIFIEDLAYER-AS-1US United States 18->41 43 www.iejel.com 104.247.82.133, 49721, 80 TEAMINTERNET-CA-ASCA Canada 18->43 45 14 other IPs or domains 18->45 55 System process connects to network (likely due to code injection or exploit) 18->55 22 control.exe 1 12 18->22         started        signatures11 process12 signatures13 57 Tries to steal Mail credentials (via file access) 22->57 59 Tries to harvest and steal browser information (history, passwords, etc) 22->59 61 Modifies the context of a thread in another process (thread injection) 22->61 63 2 other signatures 22->63 25 cmd.exe 2 22->25         started        29 cmd.exe 1 22->29         started        process14 file15 35 C:\Users\user\AppData\Local\Temp\DB1, SQLite 25->35 dropped 65 Tries to harvest and steal browser information (history, passwords, etc) 25->65 31 conhost.exe 25->31         started        33 conhost.exe 29->33         started        signatures16 process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0047270c26f603d132bc8e6a67894311356fe2d3c977aa287a09a8261f6b5690/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:41:07 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=abdsodbg6yb5cmv4rzvgpckdce2w7ywtzf32ukd2bgucmh3lk2ia._file
Verdict:
malicious
Similar samples:
00668e0dac77414a7a5fc8df4867e3a75fc928cdd97b57c068edb11522fecf97
Formbook
0d2b79e9ac449de6c300c43522e8581a971b4b08e004696e278608d6c4b46eb8
Formbook
23958a583d62bf343e2641dd871d6d788c99649a722fe1908fea9e72e78d17b7
Formbook
371a78d5f848b70de0d716586851eec55e92fc1e4e5898943c62c67a99c9e07a
Formbook
4052cabc6efdd8910b0c92b973d1a37172a92ee408fc53209d746cfb65e08dcc
Formbook
7910fbd27cb1e4fd04a3356d45036821ed924ef1b8de3117d677be4938cb5140
Formbook
7c110f7a45aba8f26ba0eb32c024ea55598ec54d9ceda6cf13272a31d2cc6da0
Formbook
a0086dfee2dba4d6a0adab05e848cfbb9755f68be7adef3ff35ff9740e5a1c2e
Formbook
b258aed05413eb191250d2907db5b64c4f36fdb0508fb3c9c6390c4144fd9497
Formbook
dee1fa115a3e06310b958baca7bf709144f770de027ab3c615f6937b7544cd75
Formbook
+ 2'342 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
evasion spyware trojan persistence stealer family:formbook
Link:
https://tria.ge/reports/200721-klrmnyfek6/
Behaviour
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Gathers network information
System policy modification
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Maps connected drives based on registry
Uses the VBS compiler for execution
Reads user/profile data of web browsers
Checks BIOS information in registry
Looks for VMWare Tools registry key
Adds policy Run key to start application
Looks for VirtualBox Guest Additions in registry
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0047270c26f603d132bc8e6a67894311356fe2d3c977aa287a09a8261f6b5690

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 39aff459babaf4488ea90b5e81e463044d4ad3b8a17a3bfcb247725a288db025

Formbook

Executable exe 0047270c26f603d132bc8e6a67894311356fe2d3c977aa287a09a8261f6b5690

(this sample)

  
Dropped by
MD5 d114e8d71cc065c1019da2c071c9541c
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 39aff459babaf4488ea90b5e81e463044d4ad3b8a17a3bfcb247725a288db025
Cape
Cape
https://www.capesandbox.com/analysis/29825/

Comments