MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fc7c86df7aa45224f6c8f4a94513663dfe77dc79603a0c1325736c376aa68e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fc7c86df7aa45224f6c8f4a94513663dfe77dc79603a0c1325736c376aa68e2
SHA3-384 hash: 8881a70c9eb065d4478d8c41329a58ac60cbfe21c8cb1f580eae85a4aa6c3bb3f40464ac1b97b92b7c001ee9cc226ce7
SHA1 hash: 5e52cfbf1f5020337a2bfafe83881217df3869dd
MD5 hash: fe9fba11b0354b03ec4374321cf5d7f2
humanhash: five-lamp-lamp-single
File name:BANCO SABADELL_etransferencia_depropiedad_SWIFT_21_06_2021.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'111'552 bytes
First seen:2021-06-22 06:22:20 UTC
Last seen:2021-06-22 06:49:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:bmqWFHmsSSMPQipP5JG/UXU9l9SG8nB2A+WwWL5ED96ZaeAiMJVpQhoEp53UC:SRHHipHCUkVWB2hr+ED96ZyquEplU
Threatray 5'892 similar samples on MalwareBazaar
TLSH 9235BF220ECF42E9E2754FB557F0AC4682F7ADAEA605A2153DC031ADCB3359ACDDE411
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TRNSF.exe
Verdict:
Malicious activity
Analysis date:
2021-06-21 18:06:34 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/0fc2e8a1-dc8d-491e-90f6-23efd20266bd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167441/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.12907.22800.20309.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b57912c9-ca16-4d2f-b822-dec2bee75f7b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/805745
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 438156 Sample: BANCO SABADELL_etransferenc... Startdate: 22/06/2021 Architecture: WINDOWS Score: 100 42 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 12 other signatures 2->48 8 BANCO SABADELL_etransferencia_depropiedad_SWIFT_21_06_2021.exe 7 2->8         started        12 explorer.exe 2->12         started        process3 dnsIp4 28 C:\Users\user\AppData\...\CgGYkEzZSUvqy.exe, PE32 8->28 dropped 30 C:\...\CgGYkEzZSUvqy.exe:Zone.Identifier, ASCII 8->30 dropped 32 C:\Users\user\AppData\Local\...\tmpE7E3.tmp, XML 8->32 dropped 34 BANCO SABADELL_etr..._21_06_2021.exe.log, ASCII 8->34 dropped 50 Injects a PE file into a foreign processes 8->50 15 BANCO SABADELL_etransferencia_depropiedad_SWIFT_21_06_2021.exe 8->15         started        18 schtasks.exe 1 8->18         started        36 www.ukuleleintensive.com 12->36 38 www.drautosaleaz.com 12->38 40 parkingpage.namecheap.com 198.54.117.215, 49745, 80 NAMECHEAP-NETUS United States 12->40 52 System process connects to network (likely due to code injection or exploit) 12->52 20 cscript.exe 12->20         started        file5 signatures6 process7 signatures8 54 Modifies the context of a thread in another process (thread injection) 15->54 56 Maps a DLL or memory area into another process 15->56 58 Sample uses process hollowing technique 15->58 60 Queues an APC in another process (thread injection) 15->60 22 conhost.exe 18->22         started        62 Tries to detect virtualization through RDTSC time measurements 20->62 24 cmd.exe 1 20->24         started        process9 process10 26 conhost.exe 24->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fc7c86df7aa45224f6c8f4a94513663dfe77dc79603a0c1325736c376aa68e2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-21 14:44:45 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7d4q3pxvjcset3mr5fjiujwmpp6o7ohsyb2bqjsk43mg5vkndra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
010f54e04b88914349c222fb020f1a02d36ef80ae2d6048df29535d19a2012f8
Formbook
2080ae2cfe843c0e1754f994b356086718dd6dceedf974ca37b629fb4da817a6
Formbook
473ec4f2b7a198ff36e66b86cbc05848883b4dffeaacb8b9c97e67e88e977986
Formbook
6120294360629da33cd6f897de16401325be12ae2cd9dcc03857de7e0b4f94e4
Formbook
9c1d6191badf084113871feba0049fac8a2bb5761136877383579cdcf7cd781a
Formbook
ad2a5569cb14f86fe191f54f6fecb7bf1fe389418858f5fc72e6367c9780a9f0
Formbook
ae894e1cebb5dcb29c64c8be3157beb1bf096e9720efb6cb976c77aaf406bace
Formbook
c2336a135878814b7b9b82146879a4ee8910e0a7e540415cb3716e1f62c1ea41
Formbook
da8ac5be69302fcd92625e881ea1494e67b97ace71fcfa9e068f7d7b004f2248
Formbook
e68f17cfe87742103150ca9abd6cc16581caa6e0e0243d03fae2c89c2609c974
Formbook
+ 5'882 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210622-zwb3hc35za/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.xzklzl.com/gbwy/
Unpacked files
SH256 hash:
c4acfbab042fc79ae2dd1d90f0d4769437c83b93507fef8095fff44c5c807647
MD5 hash:
cc99435f5a8adf19e4dc5e7251f7393a
SHA1 hash:
1e9b0c20d4a9901b33c4f3290a17b7222440a3f6
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/e7db257f-81d0-45ba-ad83-f87ace0f6f37/
Parent samples :
473ec4f2b7a198ff36e66b86cbc05848883b4dffeaacb8b9c97e67e88e977986
1fc7c86df7aa45224f6c8f4a94513663dfe77dc79603a0c1325736c376aa68e2
6e71e82dcb056af810baae26909b712ec2dc1610bbf8ebbee00b62f9bb2b3189
311c2667d094e51f0ad2596333a243ca6296d25c07223abf95af0256ed7aeb97
6164b2ec2fb35d3d23436b32a695beb72917b2fdc58b3191e2d9a83e2caac810
SH256 hash:
50d1c6af779aa92a8b90590cacc6dfcbff92293c12869bf3fb022c1bfaf43cb8
MD5 hash:
825082cffb92ab27d7f1049ba4764068
SHA1 hash:
9e38692d1f90018deb6128ca6ff1605179c1e28f
Link:
https://www.unpac.me/results/e7db257f-81d0-45ba-ad83-f87ace0f6f37/
SH256 hash:
45a2ac0c4bc41c24a7949a84c7027bbfdd4faa11cd5601665b3cd1b20e6c0a14
MD5 hash:
6138a6bcbed0ac6eb0c2ecf9d5e475e7
SHA1 hash:
6f45e26bffd2022f75aa541954ce248cfd35db95
Link:
https://www.unpac.me/results/e7db257f-81d0-45ba-ad83-f87ace0f6f37/
SH256 hash:
1fc7c86df7aa45224f6c8f4a94513663dfe77dc79603a0c1325736c376aa68e2
MD5 hash:
fe9fba11b0354b03ec4374321cf5d7f2
SHA1 hash:
5e52cfbf1f5020337a2bfafe83881217df3869dd
Link:
https://www.unpac.me/results/e7db257f-81d0-45ba-ad83-f87ace0f6f37/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1fc7c86df7aa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1fc7c86df7aa45224f6c8f4a94513663dfe77dc79603a0c1325736c376aa68e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 1fc7c86df7aa45224f6c8f4a94513663dfe77dc79603a0c1325736c376aa68e2

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/167441/

Comments