MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 262425bbcb5e75f86acb044c68560ca672503b3fb26768b733d49662ec3811cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 262425bbcb5e75f86acb044c68560ca672503b3fb26768b733d49662ec3811cb
SHA3-384 hash: 65ed34adaa828d05a74364a2802e9b3a5f33990d70f07bd4a5fd2fb14bf1194ea9dccb609512bc42a0a11d9fdf7f8df6
SHA1 hash: bfbb57d434b94c4e8be99c3fd550f92361f22537
MD5 hash: 8c10783437f67f1944a94eb04c7f70a5
humanhash: mars-louisiana-connecticut-butter
File name:nova narudžba.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:947'712 bytes
First seen:2020-10-27 10:07:11 UTC
Last seen:2020-10-27 12:16:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'614 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:nMuaTG4JNqmBYBN9CgxRt0RxfIzkZqYc/8WQlUnIMsR7zYPvHrIS4Yvsnxg:yG42N9ftQdIzupKmUITF4XUxg
Threatray 3'387 similar samples on MalwareBazaar
TLSH F01529527A919910F16A323BC26A820847F49B502693D337EDFF33AB0E17B7A7D049D5
Reporter abuse_ch
Tags:exe FormBook geo GRC


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: stella.ns1.bg
Sending IP: 79.124.76.95
From: Edina Maciej <info@elkem.gr>
Subject: Re: Re: παραγγελία για προσφορά
Attachment: nova narudžba.zip (contains "nova narudžba.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/79774/
Detection(s):
SecuriteInfo.com.Generic.mg.8c10783437f67f19.31142.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/513204
Signature
.NET source code contains potential unpacker
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 305716 Sample: nova narud#U017eba.exe Startdate: 27/10/2020 Architecture: WINDOWS Score: 100 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for dropped file 2->45 47 10 other signatures 2->47 10 nova narud#U017eba.exe 7 2->10         started        process3 file4 31 C:\Users\user\AppData\Roaming\WGWighlTe.exe, PE32 10->31 dropped 33 C:\Users\user\AppData\Local\...\tmp6EF7.tmp, XML 10->33 dropped 13 RegSvcs.exe 10->13         started        16 schtasks.exe 1 10->16         started        process5 signatures6 57 Modifies the context of a thread in another process (thread injection) 13->57 59 Maps a DLL or memory area into another process 13->59 61 Sample uses process hollowing technique 13->61 63 2 other signatures 13->63 18 explorer.exe 13->18 injected 22 conhost.exe 16->22         started        process7 dnsIp8 35 parking.namesilo.com 168.235.88.209, 49752, 80 RAMNODEUS United States 18->35 37 finopscert.com 34.102.136.180, 49751, 80 GOOGLEUS United States 18->37 39 3 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 24 explorer.exe 18->24         started        signatures9 process10 signatures11 51 Modifies the context of a thread in another process (thread injection) 24->51 53 Maps a DLL or memory area into another process 24->53 55 Tries to detect virtualization through RDTSC time measurements 24->55 27 cmd.exe 1 24->27         started        process12 process13 29 conhost.exe 27->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/262425bbcb5e75f86acb044c68560ca672503b3fb26768b733d49662ec3811cb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 07:16:25 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eysclo6llz27q2wlarggqvqmuzzfaoz7wjtwrnzt2slgf3bychfq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
306dc076ebd63fe8d969a99984470c480737e86eba1fb55ebe1ef49a8b987565
Formbook
3f1d00cc832bad31567399df69c06c23dbdc989e18178efc599ca6574d190e34
Formbook
3f3daa13de0dde36e87f536f9cbcabc3170a6ddc4bd261d8ad3d3cd8515f6790
Formbook
5169448790953f95b005aedf779cc9cc9443ab52550650cbae197033d5c227e0
Formbook
7b939c76950b25a4e132860f637b3de9f561022e96481bb5f881b21e57e5898b
Formbook
cc15e8a9e04355389815d8a7be4c34746c87a2a9d672e426c01b00ad0a583069
Formbook
d30e5bd3a0ec9e64eea4363751655f0267d7ffb00a9552862179cd8cf6caa6c0
Formbook
e132699f63854eb3c66be165867f2cafc37d29a8a3a4ca3c4c6949ed42ddde95
Formbook
e1e0a4fba3b1dc2e64ac088f5839fe75832cd9a824fd9f0f5e043821d9d18b0c
Formbook
fc6c24e17bd06e27dcc1ac019e4080d4a1a2f10459f74c17b9bb19fb8ba6e442
Formbook
+ 3'377 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201027-3a77e5ma5a/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.kumcal.com/fs8/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 9706ca8b9a00ec44578071c0ef19d7d0fff2aadd6e0d84fdd33119e7619bbbd7

Formbook

Executable exe 262425bbcb5e75f86acb044c68560ca672503b3fb26768b733d49662ec3811cb

(this sample)

  
Dropped by
MD5 e814ce689c613e4e6715cab902091ff0
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 9706ca8b9a00ec44578071c0ef19d7d0fff2aadd6e0d84fdd33119e7619bbbd7
Cape
Cape
https://www.capesandbox.com/analysis/79774/

Comments