MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 357c55fac31eb641cb3cec37663a829e2745f3cd4af08b6fc0c1634ef3eee1b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 357c55fac31eb641cb3cec37663a829e2745f3cd4af08b6fc0c1634ef3eee1b6
SHA3-384 hash: 46c98caabafb63f7bb0abc0380bff20ff18dcea6e2306e6b09d30790c323919317b127fdbcb6a57975b9eba67ec2daca
SHA1 hash: 1ee0d4ee5265df3d9705aa61e9e06847d3fc13f6
MD5 hash: 6998c8f3f3d113c70549b738074a4704
humanhash: social-juliet-alanine-iowa
File name:ORDER CONFIRMATION.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:681'472 bytes
First seen:2021-02-21 15:52:22 UTC
Last seen:2021-02-21 17:50:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:7XopkXkTbHUwUgyMLigMf+DTKVEbrBE6nuSxFoC:Dof0pt5+nfr9Bxv
Threatray 3'911 similar samples on MalwareBazaar
TLSH 1EE4AE0232A48F5DD93E07F99516C15023F5AEAAB42ED74C9ED674EB3FF1B804822617
Reporter fabjer
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118145/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61664.32674.6376.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Possible injection to a system process
Unauthorized injection to a system process
Deleting of the original file
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/613452
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for domain / URL
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: CMSTP Execution Process Creation
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 355742 Sample: ORDER CONFIRMATION.exe Startdate: 21/02/2021 Architecture: WINDOWS Score: 100 37 Multi AV Scanner detection for domain / URL 2->37 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 7 other signatures 2->43 10 ORDER CONFIRMATION.exe 3 2->10         started        process3 file4 27 C:\Users\user\...\ORDER CONFIRMATION.exe.log, ASCII 10->27 dropped 13 ORDER CONFIRMATION.exe 10->13         started        process5 signatures6 51 Modifies the context of a thread in another process (thread injection) 13->51 53 Maps a DLL or memory area into another process 13->53 55 Sample uses process hollowing technique 13->55 57 Queues an APC in another process (thread injection) 13->57 16 explorer.exe 13->16 injected process7 dnsIp8 29 www.vietristore.com 170.178.168.203, 49736, 80 ST-BGPUS United States 16->29 31 www.jafodraws.com 16->31 33 192.168.2.1 unknown unknown 16->33 35 System process connects to network (likely due to code injection or exploit) 16->35 20 cmstp.exe 16->20         started        signatures9 process10 signatures11 45 Modifies the context of a thread in another process (thread injection) 20->45 47 Maps a DLL or memory area into another process 20->47 49 Tries to detect virtualization through RDTSC time measurements 20->49 23 cmd.exe 1 20->23         started        process12 process13 25 conhost.exe 23->25         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/357c55fac31eb641cb3cec37663a829e2745f3cd4af08b6fc0c1634ef3eee1b6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-19 03:12:50 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gv6fl6wdd23edsz45q3wmouctytul46njlyiw36ayfru547o4g3a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0db69eb6654d1090cb17ab58537a7304e2c269613c0edabf123cf230d289db73
Formbook
1ec5aeccf89c5d7a378e443e742e37f05a2aa7cb71150ee0ca4876c6b37d7b4d
Formbook
418c91165a110d4877cb2932db456e37715dd6ea494712bb6cebd009eb090727
Formbook
4c51f78fbe90c4455d1a0c1f45ff575571974df030b1ea188bf9ab67f4552c68
Formbook
53d50f3185dcbe2ab1787becd3ed35c4ef019841d01c62a3bc33f4abd7f8c93c
Formbook
563bb7942710f08ce409f8418fd0d917877998c978ab0155cb3c1b5eec3b1e7b
Formbook
8c5a90a4c4470d05fff7757920aa0a8bf56edab04f4eb926ba789652f1bfc74c
Formbook
bc2cc312ba11b1945f2fc371ddc960e24ae3fa9cf9117e51d8efa152b8bee2c8
Formbook
e68f17cfe87742103150ca9abd6cc16581caa6e0e0243d03fae2c89c2609c974
Formbook
f09416ef7aaab2c43c62ef77bb69c005ec4a57d4051586f5e7d8571e74fee41c
Formbook
+ 3'901 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210221-any91ngdlx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.fun4gang.xyz/thg/
Unpacked files
SH256 hash:
3be807046cf3ef1216b191923f732d8733c626c7c56157a4fe6d7b1bab0d3e24
MD5 hash:
4f9ae5a7c06975983ed4c5a9c1db2210
SHA1 hash:
f7f7700d2e65ac995e68b91fac5cbe4f4d65d329
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/ddffe07b-544f-4236-a50d-97b4187eb3e9/
Parent samples :
bc2cc312ba11b1945f2fc371ddc960e24ae3fa9cf9117e51d8efa152b8bee2c8
357c55fac31eb641cb3cec37663a829e2745f3cd4af08b6fc0c1634ef3eee1b6
6e0b67c69b922762b4dd074cb6669f1080e78577b115bb9dd673df1b44937c6b
8eb77ec70c44e86607e97ce926cdb4e0610a0199c348fa329dba50bef34d5fc1
SH256 hash:
29a9d333678a0b4cdf8e69d05e0721da2ac6e76fa86b25eaf781fe8ded5539f7
MD5 hash:
aa14a4ef010d77ecdf75c96456aad6b1
SHA1 hash:
ce0eff9ca63e84d66f9261013f9e59f230e93c6b
Link:
https://www.unpac.me/results/ddffe07b-544f-4236-a50d-97b4187eb3e9/
SH256 hash:
f0a09c48af16c079c37ad0914f18897976357981fe5ee6f556ab9f9f70b9a671
MD5 hash:
f984a71581f6da5732110be2a569a392
SHA1 hash:
10de05b6b35fc5dbc00c42d59a4b850bcaae01e6
Link:
https://www.unpac.me/results/ddffe07b-544f-4236-a50d-97b4187eb3e9/
SH256 hash:
357c55fac31eb641cb3cec37663a829e2745f3cd4af08b6fc0c1634ef3eee1b6
MD5 hash:
6998c8f3f3d113c70549b738074a4704
SHA1 hash:
1ee0d4ee5265df3d9705aa61e9e06847d3fc13f6
Link:
https://www.unpac.me/results/ddffe07b-544f-4236-a50d-97b4187eb3e9/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 7eea298e240c3376a2e98d5280f9f99030a04d25ae60b6e9f5f04253a7398cd8

Formbook

Executable exe 357c55fac31eb641cb3cec37663a829e2745f3cd4af08b6fc0c1634ef3eee1b6

(this sample)

  
Dropped by
SHA256 7eea298e240c3376a2e98d5280f9f99030a04d25ae60b6e9f5f04253a7398cd8
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/118145/

Comments