MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39992920b2ad02ba761413d61b8c4b7eef23827d26cb50b4236f97c5af7d4d33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39992920b2ad02ba761413d61b8c4b7eef23827d26cb50b4236f97c5af7d4d33
SHA3-384 hash: 21c0da044a68fe283c2f8653193212a542c73346be0b8097e649b8977ce069af589a35dd6c28c507c393961f5042afaf
SHA1 hash: 740c982befd0e3be1b5aa3294a4481f50b30faa2
MD5 hash: 8a4fe566aacd64ccb76f460d858caa42
humanhash: autumn-angel-edward-potato
File name:vbc.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:509'095 bytes
First seen:2022-03-17 14:03:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:bGi5dY5KLzDqVsMLMESNvQpBdDWq5vqNDFmjqyxFGRP2Kc27077XZvxPcniXT:nYcXDQcQvdt5vumeP+V2Q77pvxknc
Threatray 14'164 similar samples on MalwareBazaar
TLSH T184B4E0159B14C197F3909C704ABDEB348BB44EBC2956A40BAAF07C2B717C7B57C8D12A
File icon (PE):PE icon
dhash icon a8adb8f8b8f0f0e8 (1 x Formbook)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
vbc.exe
Verdict:
Malicious activity
Analysis date:
2022-03-18 00:19:55 UTC
Tags:
installer trojan formbook stealer
Link:
https://app.any.run/tasks/5e859548-7882-4efd-8194-29a5e68db174

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/251964/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62333fd9b94fb38cb4993268/reports/c83209bc-8b09-4f8d-9593-09a9a08a1a05/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f4963bb7-15f3-47da-8751-1be962de37d9
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/958769
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Uses netsh to modify the Windows network and firewall settings
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 591247 Sample: vbc.exe Startdate: 17/03/2022 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 4 other signatures 2->46 10 vbc.exe 18 2->10         started        process3 file4 30 C:\Users\user\AppData\Local\Temp\tuces.exe, PE32 10->30 dropped 13 tuces.exe 10->13         started        process5 signatures6 54 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 13->54 56 Uses netsh to modify the Windows network and firewall settings 13->56 58 Tries to detect virtualization through RDTSC time measurements 13->58 60 Injects a PE file into a foreign processes 13->60 16 tuces.exe 13->16         started        process7 signatures8 32 Modifies the context of a thread in another process (thread injection) 16->32 34 Maps a DLL or memory area into another process 16->34 36 Sample uses process hollowing technique 16->36 38 Queues an APC in another process (thread injection) 16->38 19 netsh.exe 16->19         started        22 explorer.exe 16->22 injected process9 signatures10 48 Modifies the context of a thread in another process (thread injection) 19->48 50 Maps a DLL or memory area into another process 19->50 52 Tries to detect virtualization through RDTSC time measurements 19->52 24 cmd.exe 1 19->24         started        26 explorer.exe 178 19->26         started        process11 process12 28 conhost.exe 24->28         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/39992920b2ad02ba761413d61b8c4b7eef23827d26cb50b4236f97c5af7d4d33/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-17 13:26:25 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hgmssifsvublu5qucplbxdclp3xshat5e3fvbnbdn6l4ll35juzq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3c010d88a118ba3cc666e05c6f8f82159ac38e5486b5ed60c65d870287b8cff6
Formbook
4a0e9c1b5c23074112d8c5845451f43017d09ec024f1d993854e2fd43f8f2814
Formbook
8c7c6966c40ca10cdb43c9520c24ae932e63429fbc858b2c05f94f1bedbe0efa
Formbook
a9f8ff439d6cf51c60a5f9bba3653ea480fa72249562e11d6bc03bda8e672f5d
Formbook
eb3760a4e141a5124a475ade9acb42a90791e769250aa588d79958a4c2268985
Formbook
eb6a3606545277e3af8270d85b4940be7a710dcaf11c7351755675d81ce82d02
Formbook
ff3e94ded64b43f620ba549db99baa31abdd763209b60f7c9fc884b82cfac6d3
Formbook
+ 14'154 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:m0e8 rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220317-rhwa6acbdk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Uses the VBS compiler for execution
Executes dropped EXE
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
39992920b2ad02ba761413d61b8c4b7eef23827d26cb50b4236f97c5af7d4d33
MD5 hash:
8a4fe566aacd64ccb76f460d858caa42
SHA1 hash:
740c982befd0e3be1b5aa3294a4481f50b30faa2
Link:
https://www.unpac.me/results/fa8e26e1-e114-46ec-ba1a-71027500e36d/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/39992920b2ad/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/39992920b2ad02ba761413d61b8c4b7eef23827d26cb50b4236f97c5af7d4d33

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/251964/

Comments