MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 187785c7830aff67dd03a3bf3a067e9b760cb76f7367ee42c8e4b9c92b78d2e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 187785c7830aff67dd03a3bf3a067e9b760cb76f7367ee42c8e4b9c92b78d2e2
SHA3-384 hash: 2e8eb700fcf36f349cc3d9c6fd291162589c84c9a578d69f57e5bfeaddc16b87e041a300657ca240523b8708eaf02326
SHA1 hash: fc7955a7558b081d21c81d9e205831d8b5c21680
MD5 hash: 8c001a13d09ba58968f1ff5283ebfe94
humanhash: eighteen-bulldog-bravo-enemy
File name:price list.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:870'912 bytes
First seen:2020-12-02 14:10:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:bgtjF9IRgV+pZ33V8zv+ZTX1FgfGmY9ZTmcyMEJfNuI2qPVGNbTuMuKBD7hpvApS:UtpOq+PV8ziTnX9cDDST0sDdaS
Threatray 3'057 similar samples on MalwareBazaar
TLSH 02059E39AE492A25F47A573DC5E02051F7ADAF93A307C87D28F525CD0B23FD994D022A
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/106403/
Detection(s):
SecuriteInfo.com.Artemis8C001A13D09B.26587.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Launching cmd.exe command interpreter
Result
Gathering data
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/553631
Signature
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 325914 Sample: price list.exe Startdate: 02/12/2020 Architecture: WINDOWS Score: 100 33 www.saboortii.com 2->33 35 saboortii.com 2->35 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected AntiVM_3 2->47 49 5 other signatures 2->49 11 price list.exe 3 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\price list.exe.log, ASCII 11->31 dropped 59 Injects a PE file into a foreign processes 11->59 15 price list.exe 11->15         started        18 price list.exe 11->18         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 20 explorer.exe 15->20 injected process9 dnsIp10 37 www.ecomwealthfast.com 74.208.236.118, 49737, 80 ONEANDONE-ASBrauerstrasse48DE United States 20->37 39 alluvionsupply.com 160.153.136.3, 49741, 80 GODADDY-AMSDE United States 20->39 41 2 other IPs or domains 20->41 51 System process connects to network (likely due to code injection or exploit) 20->51 24 wlanext.exe 20->24         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 24->53 55 Maps a DLL or memory area into another process 24->55 57 Tries to detect virtualization through RDTSC time measurements 24->57 27 cmd.exe 1 24->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/187785c7830aff67dd03a3bf3a067e9b760cb76f7367ee42c8e4b9c92b78d2e2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-02 14:10:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=db3ylr4dbl7wpxiduo7tubt6tn3azn3pont64qwi4s44sk3y2lra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01dcab439656ed811b8bb194120735d6bd956f6cf747f97d0adba3b47d13daa8
Formbook
06a0e3845d7b4c5593a9143eb1ae73223760d68f2acf0e5be631b9eeab3675f3
Formbook
07b296fafcefb5dbbf7148a96fc968664011aca0070b72732fb00886fbea9741
Formbook
106f9f66c54be3c20be8f04ce63f5d6183d6eb9e79a6b243b5c820cc01ee24cb
Formbook
353e4fd91fe618f5c22c9cae00e7575e9b1914576ff7e332d03ca3e9f7dbbbbc
Formbook
59793c1ac9d8537e06996b0a09f161deb98a77d527b0bc97b18e15972f120a2d
Formbook
95deccdc9ef87962793e87e162d62c1d07c56dbae3b964d93e79c190f38183f7
Formbook
a8534e310ee42756cfc01caf1eeddc8f4bca6e7e7f36de1a90f5c6ccc480e90a
Formbook
da8c31096f9e2ffc9a1fea4a63d6440cfda55349845300b4f333a02317c73dde
Formbook
e38e6ac839b8009c1c6d467ed4206f912c39a15af7a1fa7ba4a2a854e441fe50
Formbook
+ 3'047 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201202-lt63rsqccj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.danneroll.com/mnc/
Unpacked files
SH256 hash:
187785c7830aff67dd03a3bf3a067e9b760cb76f7367ee42c8e4b9c92b78d2e2
MD5 hash:
8c001a13d09ba58968f1ff5283ebfe94
SHA1 hash:
fc7955a7558b081d21c81d9e205831d8b5c21680
Link:
https://www.unpac.me/results/a7ad7b5d-7578-408c-af72-dfe0f44958f4/
SH256 hash:
9584f6d01e6452371cc9b4828030a13045d99c243c497b63628828e66aabe26f
MD5 hash:
7476e403eef14ac403c63c7279831780
SHA1 hash:
8387f558e30dc115987ac2b5c174a41302471abf
Link:
https://www.unpac.me/results/a7ad7b5d-7578-408c-af72-dfe0f44958f4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/187785c7830aff67dd03a3bf3a067e9b760cb76f7367ee42c8e4b9c92b78d2e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/106403/

Comments