MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 049f2bcbaa6d18cf9ee22b12c47ba8578c938d04df6d35a3c4cd3ed81fdcf4ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 049f2bcbaa6d18cf9ee22b12c47ba8578c938d04df6d35a3c4cd3ed81fdcf4ab
SHA3-384 hash: b32ac6e2c990f268181d996aa2de4147c81debc51fe53b0f802cdcf69de50180b9dc967bbdf89a1209132f0ede696225
SHA1 hash: 00d79cc5f489f6cf35c9d12accafdf11393b399c
MD5 hash: 3e212283c8f1fdbbe2334ba3b59cab2f
humanhash: johnny-angel-potato-kitten
File name:3e212283c8f1fdbbe2334ba3b59cab2f.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:878'080 bytes
First seen:2021-06-14 14:29:54 UTC
Last seen:2021-06-14 16:06:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 24576:4llcpVATLMqmD6lhLuTC9y0Q512Z2qlkma:LOL82lhLEC4KZ9T
Threatray 5'673 similar samples on MalwareBazaar
TLSH 0215E02613C89B85FA7E47789165419083F1F92BD326EBCDBD9904DD0BA0F818363B5B
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
288
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3e212283c8f1fdbbe2334ba3b59cab2f.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-14 14:34:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/10634675-c0aa-41f6-b325-f0fe171723e6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Artemis3E212283C8F1.10127.15476.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a26d745-394f-4963-9ad0-7d09dadb638d
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/801859
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 434255 Sample: ql94lXDObD.exe Startdate: 14/06/2021 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 6 other signatures 2->40 8 ql94lXDObD.exe 3 2->8         started        12 explorer.exe 2->12         started        process3 dnsIp4 26 C:\Users\user\AppData\...\ql94lXDObD.exe.log, ASCII 8->26 dropped 42 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->42 44 Tries to detect virtualization through RDTSC time measurements 8->44 15 ql94lXDObD.exe 8->15         started        18 ql94lXDObD.exe 8->18         started        28 www.ranchfiberglas.com 147.255.30.106, 49694, 80 LEASEWEB-USA-LAX-11US United States 12->28 30 www.mothererph.com 12->30 32 mothererph.com 34.102.136.180, 49695, 80 GOOGLEUS United States 12->32 46 System process connects to network (likely due to code injection or exploit) 12->46 20 raserver.exe 12->20         started        file5 signatures6 process7 signatures8 48 Modifies the context of a thread in another process (thread injection) 15->48 50 Maps a DLL or memory area into another process 15->50 52 Sample uses process hollowing technique 15->52 54 Queues an APC in another process (thread injection) 15->54 56 Tries to detect virtualization through RDTSC time measurements 20->56 22 cmd.exe 1 20->22         started        process9 process10 24 conhost.exe 22->24         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/049f2bcbaa6d18cf9ee22b12c47ba8578c938d04df6d35a3c4cd3ed81fdcf4ab/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-14 09:30:53 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
03805a08ddc03ad125ae1566868e0ccde7965350d760dc212a224ab10520a2d8
Formbook
37e98fef85aeb5097a5091d11fc844487642873e9e06a8d0734785dbe1ad1315
Formbook
38acc90cd6d33b61b99cca8cf06781e1bd2ab8ffebc3a33e036eca36037d413b
Formbook
5372118bedc7e54daeed321ca6e2271d9a53dfe37ffab9b9f8ea91e8a3520ef5
Formbook
6aca638f8c9405c4c02bb3f2b5f5e5bc9d5596f8c68a57fb99347031415b584b
Formbook
964879f3193645b71e10534ec04ea701bccf583f3f17c7d8ca3daeac0454d97e
Formbook
98b0ffba12ebffdb7f0ebeaa1a9c402098c1b3fc6d7b9a68ece1ec73855abbd6
Formbook
cccbd0b2d46adeb6d99413af4d5a4492cd530922a09724f04c8fb1e0c47d8326
Formbook
f10508b4bd982e597771e6128fede0b532c42cb799ac495c922940c27a942dbe
Formbook
f130539b2d2324246449abb99f5a0effb214feee629b092d48ac63aca14e2ba6
Formbook
+ 5'663 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook evasion rat spyware stealer trojan
Link:
https://tria.ge/reports/210614-cec9vy2qaj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Formbook Payload
Looks for VirtualBox Guest Additions in registry
Formbook
Malware Config
C2 Extraction:
http://www.yellow-wink.com/nff/
Unpacked files
SH256 hash:
82fe42ffa7c2160c4ba79b666ba52f6dce210e0be5cbbb1419ddf3058215568b
MD5 hash:
a7c717e07a9e8fc3408914687859cf8a
SHA1 hash:
862f0e3f4f99c7674a540327ba08792e8a6cf5a1
Link:
https://www.unpac.me/results/4d6349ec-463e-4527-b5dd-17cd6b7584de/
SH256 hash:
049f2bcbaa6d18cf9ee22b12c47ba8578c938d04df6d35a3c4cd3ed81fdcf4ab
MD5 hash:
3e212283c8f1fdbbe2334ba3b59cab2f
SHA1 hash:
00d79cc5f489f6cf35c9d12accafdf11393b399c
Link:
https://www.unpac.me/results/4d6349ec-463e-4527-b5dd-17cd6b7584de/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/049f2bcbaa6d18cf9ee22b12c47ba8578c938d04df6d35a3c4cd3ed81fdcf4ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 049f2bcbaa6d18cf9ee22b12c47ba8578c938d04df6d35a3c4cd3ed81fdcf4ab

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1364102/
  
Delivery method
Distributed via web download

Comments