MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29f154b8c244af71ad5dda7bee1e41896e78cf7e5f189219754962c10bcd4183. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29f154b8c244af71ad5dda7bee1e41896e78cf7e5f189219754962c10bcd4183
SHA3-384 hash: a75fdf06c662a50a65d7ce4ab42fb3e686a6df9af29eb4567ae0f7891cccb76203c6f15bc90f0de737091d4e737978c8
SHA1 hash: c903950fef8f029eda21f9bfe44f0c347471de35
MD5 hash: 293b5da09841ae1984a6478fd3caaf24
humanhash: juliet-jersey-johnny-nine
File name:180120211200.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'161'728 bytes
First seen:2021-01-18 08:34:34 UTC
Last seen:2021-01-18 10:42:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 24576:qzeLEVSp6dJxYCuPill0cw7LuH70t7Tan4eg3ROLMGUB7VUJyW8t:qzeEVFdJxYzWWr7Lfi4beMGUB7VAy
Threatray 777 similar samples on MalwareBazaar
TLSH A3359D1153DCDF20E3BC56F8A900926067A8E546F654E37CF9BEA0C25F62DA449DFB80
Reporter abuse_ch
Tags:exe FormBook geo KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm49.hanmail.net
Sending IP: 203.133.180.237
From: 민상윤 <msy8033@daum.net>
Subject: 설계서 및 견적서 요청에 관한 건
Attachment: 180120211200.cab (contains "180120211200.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
180120211200.exe
Verdict:
Malicious activity
Analysis date:
2021-01-18 09:02:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ed708377-3597-4d32-b4f6-20a3c9c76b18

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/112491/
Detection(s):
SecuriteInfo.com.generic.ml.11684.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/583495
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 340784 Sample: 180120211200.exe Startdate: 18/01/2021 Architecture: WINDOWS Score: 100 46 Malicious sample detected (through community Yara rule) 2->46 48 Sigma detected: Scheduled temp file as task from temp location 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 9 other signatures 2->52 10 180120211200.exe 7 2->10         started        process3 file4 32 C:\Users\user\AppData\Roaming\HNQrxVm.exe, PE32 10->32 dropped 34 C:\Users\user\...\HNQrxVm.exe:Zone.Identifier, ASCII 10->34 dropped 36 C:\Users\user\AppData\Local\...\tmp89DD.tmp, XML 10->36 dropped 38 C:\Users\user\...\180120211200.exe.log, ASCII 10->38 dropped 62 Tries to detect virtualization through RDTSC time measurements 10->62 64 Injects a PE file into a foreign processes 10->64 14 180120211200.exe 10->14         started        17 schtasks.exe 1 10->17         started        signatures5 process6 signatures7 66 Modifies the context of a thread in another process (thread injection) 14->66 68 Maps a DLL or memory area into another process 14->68 70 Sample uses process hollowing technique 14->70 72 Queues an APC in another process (thread injection) 14->72 19 explorer.exe 14->19 injected 23 conhost.exe 17->23         started        process8 dnsIp9 40 elinvoimainenperhe.com 50.87.193.205, 49753, 80 UNIFIEDLAYER-AS-1US United States 19->40 42 mystiquerubirosarum.com 34.102.136.180, 49756, 80 GOOGLEUS United States 19->42 44 2 other IPs or domains 19->44 54 System process connects to network (likely due to code injection or exploit) 19->54 25 netsh.exe 19->25         started        signatures10 process11 signatures12 56 Modifies the context of a thread in another process (thread injection) 25->56 58 Maps a DLL or memory area into another process 25->58 60 Tries to detect virtualization through RDTSC time measurements 25->60 28 cmd.exe 1 25->28         started        process13 process14 30 conhost.exe 28->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29f154b8c244af71ad5dda7bee1e41896e78cf7e5f189219754962c10bcd4183/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 08:35:23 UTC
AV detection:
8 of 45 (17.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fhyvjogcisxxdlk53j564hsbrfxhrt36l4mjeglvjfrmcc6nigbq._file
Verdict:
unknown
Similar samples:
0aa319b22736e50f9486096af97cf5d70a4b072116d52c2872708295732862a5
Formbook
26512ebf31c0f58d0d294d695f1a00c75ae5c9fc1a2938454fd91c0665ceb96a
Formbook
33e5b9b9a361d29f0e747be2ba6a2357ee71a8b9761fa5e98b9c7ee1757d6bdf
Formbook
5e31a4916e479c18347d59e0a98dc12738efb5acbad3ba3e677fb24fd87e7adc
Formbook
67710323c3dd7ba7cc04081512bdb304b4d7edd72975f2891c1f5893fdb75a8a
Formbook
8806e27a6f463fd221e6c97240c59e879bb6896d4f8f0e5291bc6c2e4c2c6fb9
Formbook
9972434ebdd96cf98cbc8849f08d6ca3120e5cf2553b3416bc0fccc5396c74b5
Formbook
9c9adb16561049288fd3f771b795890e2f9efa66c2eeb121cea935e7f843ce46
Formbook
d8d17b08f8e18672119192f31fd6cf3f67c7772ca7afd4ff8f752bf1d825a046
Formbook
f3b3138f016ca71657f2289fa5dec16bec138c3ed5632c244e6e36161106b45d
Formbook
+ 767 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210118-y8t9sj82yx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.southsideflooringcreations.com/dkk/
Unpacked files
SH256 hash:
1d6ecf546163882d34d4bb2b7afa3889506ca3036ed536c4ed972ed89bdf5035
MD5 hash:
fb169513679d349cb2a7e4121bacfd4a
SHA1 hash:
26619d7ce0a175b9fc4fbfd7f4b105050562924f
Link:
https://www.unpac.me/results/dbea5766-03ba-48af-b7c5-906ccad1d58b/
SH256 hash:
29f154b8c244af71ad5dda7bee1e41896e78cf7e5f189219754962c10bcd4183
MD5 hash:
293b5da09841ae1984a6478fd3caaf24
SHA1 hash:
c903950fef8f029eda21f9bfe44f0c347471de35
Link:
https://www.unpac.me/results/dbea5766-03ba-48af-b7c5-906ccad1d58b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/29f154b8c244af71ad5dda7bee1e41896e78cf7e5f189219754962c10bcd4183

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab 6089c2a7b5388738b73be52e1ba4729a5dfc6641da33b2c5cbaa34c9b2785147

Formbook

Executable exe 29f154b8c244af71ad5dda7bee1e41896e78cf7e5f189219754962c10bcd4183

(this sample)

  
Dropped by
MD5 c097066605216043148a3e8eca3a1abd
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/112491/
  
Dropped by
SHA256 6089c2a7b5388738b73be52e1ba4729a5dfc6641da33b2c5cbaa34c9b2785147

Comments