MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 280e68610d554a53b9986a3c71780b7de25914486c37d32b4479e50168645073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 280e68610d554a53b9986a3c71780b7de25914486c37d32b4479e50168645073
SHA3-384 hash: eee2e29e45a3cab36db5ed5dd9c06c1fac2071cdd52a49dea74562ee514e8060c34d86eba8ca340f34a97578696a49cc
SHA1 hash: 0fce2234db3602e2e9bb6dd6c58efbfead86bdcf
MD5 hash: 3d5487ca508e761aff729a8137ca312f
humanhash: jupiter-arizona-fillet-winner
File name:3d5487ca508e761aff729a8137ca312f.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:787'456 bytes
First seen:2021-01-29 08:43:38 UTC
Last seen:2021-01-29 10:54:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:7/m1Iozy0rvhMerX4bReNscpWc08bWd/+/Qq9l3e:SyoB2eCANf0WWdVq9lu
Threatray 3'670 similar samples on MalwareBazaar
TLSH 59F48C212398AB6AF5BF5F3442260000E3F5A562E757EB5DFEE204DF1C25B40EA66743
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CREDIT NOTE DEBIT NOTE 27.1.2021.xlsx
Verdict:
Malicious activity
Analysis date:
2021-01-27 05:55:31 UTC
Tags:
encrypted exploit CVE-2017-11882 loader trojan formbook stealer
Link:
https://app.any.run/tasks/9d4d59db-da31-4481-b6af-4a0198fb7e04

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/114668/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.471.12026.15535.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/593683
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 345881 Sample: wYpMWI3N52.exe Startdate: 29/01/2021 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->36 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 6 other signatures 2->42 10 wYpMWI3N52.exe 3 2->10         started        process3 file4 28 C:\Users\user\AppData\...\wYpMWI3N52.exe.log, ASCII 10->28 dropped 52 Tries to detect virtualization through RDTSC time measurements 10->52 54 Injects a PE file into a foreign processes 10->54 14 wYpMWI3N52.exe 10->14         started        signatures5 process6 signatures7 56 Modifies the context of a thread in another process (thread injection) 14->56 58 Maps a DLL or memory area into another process 14->58 60 Sample uses process hollowing technique 14->60 62 Queues an APC in another process (thread injection) 14->62 17 explorer.exe 14->17 injected process8 dnsIp9 30 loudlocks.com 34.102.136.180, 49755, 80 GOOGLEUS United States 17->30 32 grandmasalt.com 34.98.99.30, 49759, 80 GOOGLEUS United States 17->32 34 10 other IPs or domains 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 wlanext.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/280e68610d554a53b9986a3c71780b7de25914486c37d32b4479e50168645073/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-27 12:43:29 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3013607bfee8bcca1767c2a33cea94602e3c97baba31f96fc8a08014cf2576b4
Formbook
3ce15be8f0a31d5fa5a176c3abb3729fd834a6af3e8a69b35cc6f2dd54c66fdb
Formbook
56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275
Formbook
5adeb6184ee1dffad88ac180f1e7dcbd6f451fc8dcd5e868906fca11d98476ef
Formbook
a078d966a3ac5a7ac639b01ba4d3230c7554d7d75e9e7f59dc35b623aec8dbda
Formbook
b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f
Formbook
c94c6548dd723a5b6aac345f8aae65d4d8c6e86c3e86195c32616ab5dfa8cba9
Formbook
cf6959fe2bb4c2e078a8bb51c097dfd79bc0ca5cd296090a897ecb30a3ee6102
Formbook
f59df25daa1bbe11f38724ad0b36eebc535f1f36ae3796ce5bebe1049cbb57ed
Formbook
f78a6375389df1b721be110480efd240f604f51868031e72d88cb7612616fb67
Formbook
+ 3'660 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210129-qb3adgm7n6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.embracingmyjourney.net/p7t/
Unpacked files
SH256 hash:
2681e8e4ea11b8ad2e5647611ffb26571c8d70fe74a72906bf74689045054b76
MD5 hash:
a8b3eedb0a0ada743f56e178f6647a88
SHA1 hash:
02f5fb5e128dca0d4483135659888ce392039db3
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/9e14df76-a5bf-40b9-b176-2000c890c1f4/
Parent samples :
c94c6548dd723a5b6aac345f8aae65d4d8c6e86c3e86195c32616ab5dfa8cba9
56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275
a078d966a3ac5a7ac639b01ba4d3230c7554d7d75e9e7f59dc35b623aec8dbda
b37ed83e211a60e98f12b924df6a9eecebb4b6f5c60cc58aa1468bddc611480f
5adeb6184ee1dffad88ac180f1e7dcbd6f451fc8dcd5e868906fca11d98476ef
3013607bfee8bcca1767c2a33cea94602e3c97baba31f96fc8a08014cf2576b4
3ce15be8f0a31d5fa5a176c3abb3729fd834a6af3e8a69b35cc6f2dd54c66fdb
280e68610d554a53b9986a3c71780b7de25914486c37d32b4479e50168645073
SH256 hash:
3694465e87dda05395df00924464bf49f16f773b07d0810df82df3f974f00196
MD5 hash:
80eefa1ef7d6ab4b105af35f3a5a9464
SHA1 hash:
ca2a79fdfbd419fd0f0e222f93dc1d6dbda96fd3
Link:
https://www.unpac.me/results/9e14df76-a5bf-40b9-b176-2000c890c1f4/
SH256 hash:
23b0a8e4c8802bd7f18324ce89168f4faa97ef2175896a16ac0e6ad5d1b21bab
MD5 hash:
1bdbeca7101d4b7b6e579f72dbb0d2bd
SHA1 hash:
5fc3bfe318d8038f360b836a9583502140290a78
Link:
https://www.unpac.me/results/9e14df76-a5bf-40b9-b176-2000c890c1f4/
SH256 hash:
280e68610d554a53b9986a3c71780b7de25914486c37d32b4479e50168645073
MD5 hash:
3d5487ca508e761aff729a8137ca312f
SHA1 hash:
0fce2234db3602e2e9bb6dd6c58efbfead86bdcf
Link:
https://www.unpac.me/results/9e14df76-a5bf-40b9-b176-2000c890c1f4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/280e68610d554a53b9986a3c71780b7de25914486c37d32b4479e50168645073

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 280e68610d554a53b9986a3c71780b7de25914486c37d32b4479e50168645073

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/978568/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/114668/

Comments