MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
SHA3-384 hash: c53c6c33da2666685c542ee3825b1ee346d2bcefc2c920a23527c68855a18cb33abcd783c4b171a59af3eb97869395c4
SHA1 hash: bc74be7970866feb94edb76a5dd62dff7722a165
MD5 hash: c85b80c8a60460b16bcba9ede71fe5ff
humanhash: oxygen-emma-green-seventeen
File name:g5f91.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:440'832 bytes
First seen:2020-10-01 21:43:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:CftshgMXm0RbDUY8bk/aWTuiDcNhrS0IjaawcVO7hLpFU:CzqpDU7kzcN9S0IjaawcVOdL/U
Threatray 2'327 similar samples on MalwareBazaar
TLSH 5994DF2D2B848793CEA6D27C2039CF04B6F2C46A525FF711DFADD075218E3B25672296
Reporter malware_traffic
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/67539/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Launching cmd.exe command interpreter
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/479785
Signature
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 292332 Sample: g5f91.exe Startdate: 01/10/2020 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Sigma detected: Scheduled temp file as task from temp location 2->48 50 5 other signatures 2->50 10 g5f91.exe 7 2->10         started        process3 file4 34 C:\Users\user\AppData\Local\...\tmpCAFF.tmp, XML 10->34 dropped 36 C:\Users\user\AppData\...\tfPErTSwFfzBj.exe, PE32 10->36 dropped 54 Tries to detect virtualization through RDTSC time measurements 10->54 56 Injects a PE file into a foreign processes 10->56 14 g5f91.exe 10->14         started        17 schtasks.exe 1 10->17         started        19 g5f91.exe 10->19         started        signatures5 process6 signatures7 64 Modifies the context of a thread in another process (thread injection) 14->64 66 Maps a DLL or memory area into another process 14->66 68 Sample uses process hollowing technique 14->68 70 Queues an APC in another process (thread injection) 14->70 21 explorer.exe 14->21 injected 25 conhost.exe 17->25         started        process8 dnsIp9 38 masteronlineteams.com 34.102.136.180, 49735, 80 GOOGLEUS United States 21->38 40 www.madfishrods.com 199.59.242.153, 49737, 80 BODIS-NJUS United States 21->40 42 3 other IPs or domains 21->42 52 System process connects to network (likely due to code injection or exploit) 21->52 27 help.exe 21->27         started        signatures10 process11 signatures12 58 Modifies the context of a thread in another process (thread injection) 27->58 60 Maps a DLL or memory area into another process 27->60 62 Tries to detect virtualization through RDTSC time measurements 27->62 30 cmd.exe 1 27->30         started        process13 process14 32 conhost.exe 30->32         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d/
Threat name:
ByteCode-MSIL.Trojan.Zonidel
Create hunting rule
Status:
Malicious
First seen:
2020-10-01 21:45:11 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=au4k23r7slvbhjnd3lnrr2ahzytas6572l2hh2dtuuklnw56r5oq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
19b8d7da5a00f2ef97531fda2db336b31c19a73c482e8528c21730a8ff372786
Formbook
3e8e7c9ebb8ae4bbb723e1974f176f8cb82ec0fb4e1890ee1f4feed08ae76058
Formbook
40ebb3d580358ecb3e79734349f0f5d4683cb907adad005c467a06f72a6110e2
Formbook
426ffa75739fe8c76f9b42c13944cbde5de6715394131f8e02fa83027de328f2
Formbook
85f9c52380c96ddf3aa66361640a6a6232a182d5d4437de8a3585fa0d216ebc4
Formbook
884fbcf398a2c6a229040d209f39e5ca66bf5100f9707cccf0c6f5e3bd6ecb5a
Formbook
9c0d3c463792d704909de3a04cd7a6d31f8094301e8e24950af31cdc5e9f2838
Formbook
a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445
Formbook
b9c1be5f81b9261b1bb68fb0f667a57721bd04b750427a9382844c42d18dba6e
Formbook
b9cd83c667b694ec10f884183b138beeb0f986a7d3c50af463535852f2fa0663
Formbook
+ 2'317 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201001-jdy7wp2bas/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.elevatedqueensnc.com/ajr/
Unpacked files
SH256 hash:
eff96892eef8f2c5dfa52e7023efa75e677cc7574aac8d03c4eeb6b78e5263db
MD5 hash:
33c5c5ceb7fa841098121ebd127cb8cc
SHA1 hash:
29121583268ee9ebce22388d02d9c781d14119f3
Link:
https://www.unpac.me/results/5283d04e-61c4-452c-b7fb-c426956acc01/
SH256 hash:
ceef880e8dd65047331aa2b11c46ae62685364b5758a363c4503bdc014a6179f
MD5 hash:
37fdc1379d5fc04b3fe5b61fb98a3d60
SHA1 hash:
38122fd6394de4863b3ed9a7c2a1185e9a119de8
Link:
https://www.unpac.me/results/5283d04e-61c4-452c-b7fb-c426956acc01/
SH256 hash:
671bebb7dbb43ac00b3d0ffe6d914a0a611383824f3c5e54e59dfc9e4107ebb3
MD5 hash:
5340838649125e545d572d85d7512d08
SHA1 hash:
e8589047316b7a9f90191dd0e3a4c60a84ae684b
Link:
https://www.unpac.me/results/5283d04e-61c4-452c-b7fb-c426956acc01/
SH256 hash:
2e62cdc2bcfb40cfadfaaf8f15c5b2cb18d293240c40137506e593b309a2ad00
MD5 hash:
e9b4d866a5fce473853ebe67d7b44344
SHA1 hash:
5a90e25d4b630026faeb4df52f18b4d7ed0e32d7
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/5283d04e-61c4-452c-b7fb-c426956acc01/
Parent samples :
0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
145880ed94e0db3cab65cb54db4728520f1ac5f95ff2b0dda2650233542dd706
bfae046475f1458c460cf4eed534a48c8e769fbfc622138170c3945a4ad61a90
b7859dd4f12959b0c3b717089ddde8f623d288e27d092d93b06afaf9fc4a51d8
1d9958a0a083b0f134bf5c777e6cee112d30f6059e3f7d301cf78e3777b7a637
5c5f5e9cd06c7c7da03edfc2cd3dd6d45cfdcb5fe1b8e1fbb26fa63c264eb3b6
SH256 hash:
0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
MD5 hash:
c85b80c8a60460b16bcba9ede71fe5ff
SHA1 hash:
bc74be7970866feb94edb76a5dd62dff7722a165
Link:
https://www.unpac.me/results/5283d04e-61c4-452c-b7fb-c426956acc01/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/67539/
  
URLhaus
https://urlhaus.abuse.ch/url/637046/
  
Delivery method
Distributed via web download

Comments