MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30b4c1056fb6b1568249421bb9a8fac66267e60b49d090d718943ba40ed24151. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30b4c1056fb6b1568249421bb9a8fac66267e60b49d090d718943ba40ed24151
SHA3-384 hash: 69bb55c145e590d7aaaeb92a904c5f995e4d3fb5bfed73638c7e893348d9ab656ad030eb5458072f4068c6051b4c18c5
SHA1 hash: 59ba5d23ea1250dd306d6ee8c3fc185e19cb3767
MD5 hash: 9586807350390f970dac7146411a56f2
humanhash: low-salami-early-three
File name:New Sample_4522.Scan.pdf....exe
Download: download sample
Signature FormBook
Create hunting rule
File size:678'912 bytes
First seen:2020-10-02 09:01:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:CfPQQn2PVRiY/IF0IfTgYSc4ISudAARorC4G5XX19rca:CHn2yDF0gSRI7voXIbrca
Threatray 2'297 similar samples on MalwareBazaar
TLSH D3E4DF41A680D644DCB957F0E1389DF007AB7C6AE974F14F1E497EE636B33C21662A0B
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/67683/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.373.130.3859.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/480057
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
Detected FormBook malware
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Steal Google chrome login data
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 292468 Sample: New Sample_4522.Scan.pdf....exe Startdate: 02/10/2020 Architecture: WINDOWS Score: 100 54 www.istnew.com 2->54 56 prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com 2->56 64 Malicious sample detected (through community Yara rule) 2->64 66 Antivirus detection for dropped file 2->66 68 Antivirus / Scanner detection for submitted sample 2->68 70 13 other signatures 2->70 11 New Sample_4522.Scan.pdf....exe 3 2->11         started        signatures3 process4 file5 52 C:\...52ew Sample_4522.Scan.pdf....exe.log, ASCII 11->52 dropped 14 New Sample_4522.Scan.pdf....exe 11->14         started        17 New Sample_4522.Scan.pdf....exe 11->17         started        process6 signatures7 84 Modifies the context of a thread in another process (thread injection) 14->84 86 Maps a DLL or memory area into another process 14->86 88 Sample uses process hollowing technique 14->88 90 Queues an APC in another process (thread injection) 14->90 19 explorer.exe 3 7 14->19 injected process8 dnsIp9 58 www.sangyey.com 45.207.123.138, 49734, 49735, 49736 XIAOZHIYUN1-AS-APICIDCNETWORKUS Seychelles 19->58 60 www.toolsup.online 80.78.22.55, 49733, 80 CYBERDYNELR Cyprus 19->60 44 C:\Users\user\AppData\...\ofcltybc0rjb.exe, PE32 19->44 dropped 46 C:\Program Files (x86)\...\ofcltybc0rjb.exe, PE32 19->46 dropped 72 System process connects to network (likely due to code injection or exploit) 19->72 74 Benign windows process drops PE files 19->74 24 cmstp.exe 1 18 19->24         started        28 ofcltybc0rjb.exe 2 19->28         started        30 ofcltybc0rjb.exe 2 19->30         started        file10 signatures11 process12 file13 48 C:\Users\user\AppData\...\224logrv.ini, data 24->48 dropped 50 C:\Users\user\AppData\...\224logri.ini, data 24->50 dropped 76 Detected FormBook malware 24->76 78 Tries to steal Mail credentials (via file access) 24->78 80 Tries to harvest and steal browser information (history, passwords, etc) 24->80 82 3 other signatures 24->82 32 cmd.exe 2 24->32         started        36 cmd.exe 1 24->36         started        signatures14 process15 file16 42 C:\Users\user\AppData\Local\Temp\DB1, SQLite 32->42 dropped 62 Tries to harvest and steal browser information (history, passwords, etc) 32->62 38 conhost.exe 32->38         started        40 conhost.exe 36->40         started        signatures17 process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30b4c1056fb6b1568249421bb9a8fac66267e60b49d090d718943ba40ed24151/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-02 08:15:12 UTC
AV detection:
37 of 48 (77.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gc2mcblpw2yvnasjiin3tkh2yzrgpzqljhijbvyysq52idwsifiq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
23b880c48fec41fa4fc337f0ecb3d9cd5ee8f71cd45448049a35bbcb85bb01f5
FormBook
2ead77594bc7d6fb376764fad896f830955a1ac70155c0f9feb42299f5c788a9
FormBook
33500d82b580ebcc34521dd70217ba0cf976d4708f6d9d413388aae64317b43d
FormBook
353e4fd91fe618f5c22c9cae00e7575e9b1914576ff7e332d03ca3e9f7dbbbbc
FormBook
6612e640d15ed26414fc5c288b9bb7050db90517febb11d4b5145fb8d84441b9
FormBook
693c8d97b8f35a60fbe94951bcc62bfe7d98631591382a2a86300546c6fa95d0
FormBook
8aafecddd3b462d27c24000757496edb5c6bce1e6abff9157d5360457b0805d7
FormBook
ad660d774f78137622d038976557c8782211dbfd39d2ff9a7a4bcc9279ba0f41
FormBook
b942a8a8c29b7e6245285fb893a10994f97af37b33eef8579820376016ee021d
FormBook
f22a0b5b12687ae12b9f4d625d82a16562bce5e1b03b7d7372df3813e5afc8e5
FormBook
+ 2'287 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook persistence
Link:
https://tria.ge/reports/201002-6snfsq3wm2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.toolsup.online/so6/
Unpacked files
SH256 hash:
30b4c1056fb6b1568249421bb9a8fac66267e60b49d090d718943ba40ed24151
MD5 hash:
9586807350390f970dac7146411a56f2
SHA1 hash:
59ba5d23ea1250dd306d6ee8c3fc185e19cb3767
Link:
https://www.unpac.me/results/6f9773e2-d387-4364-bf8c-cf9aaa335151/
SH256 hash:
23807664cd4efe25fd0e5e389708a79244c9ee5243edf4d3fb102341232f07a5
MD5 hash:
93ee2e2f4ea9cc2921144f1373e79d3c
SHA1 hash:
46a112b70299a4f3102ab72011f17d776d5d82f7
Link:
https://www.unpac.me/results/6f9773e2-d387-4364-bf8c-cf9aaa335151/
SH256 hash:
e0f1f79b7a1e0479c53c843a8ea203ecd06904c0e62c6caea57e1e18b633fc26
MD5 hash:
5b55ea896a010fc6fc2153f8d024fdef
SHA1 hash:
9b53617683dbafa76a71a0ed64e8d12caa0f79af
Link:
https://www.unpac.me/results/6f9773e2-d387-4364-bf8c-cf9aaa335151/
SH256 hash:
2137177e167a4806bdde13fef46b4ae8db23c77ce04a1c0013dc3aea54098d32
MD5 hash:
7c6f0d3b1130f4d21ef0fd4eb295ec66
SHA1 hash:
d6c1477c3d837df94bde80c677f3d8a1e54af6f6
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/6f9773e2-d387-4364-bf8c-cf9aaa335151/
Parent samples :
30b4c1056fb6b1568249421bb9a8fac66267e60b49d090d718943ba40ed24151
c787057c00b515e2c4c78968650b5978b9b696a9668ee33d82d86a623d5c5752
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/30b4c1056fb6b1568249421bb9a8fac66267e60b49d090d718943ba40ed24151

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe 30b4c1056fb6b1568249421bb9a8fac66267e60b49d090d718943ba40ed24151

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/67683/

Comments