MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1
SHA3-384 hash: 168896f2238a66d2dd76e0edb7207f67386126eb45cf8e317e7e82370e9c792791324071925ed83acc9bf2a13539371b
SHA1 hash: 7708d1ed2bb3166bf74d0e92ac95bb8e379e1cf4
MD5 hash: 774eca4068dce6d3db505c49af0a516e
humanhash: delaware-venus-pasta-mirror
File name:PO7321.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:576'164 bytes
First seen:2021-04-08 07:04:42 UTC
Last seen:2021-04-08 08:26:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 18bc6fa81e19f21156316b1ae696ed6b (51 x Formbook, 24 x Loki, 9 x SnakeKeylogger)
ssdeep 6144:mdm0rQdjIvD2Jb6le9ZRuu1nc361e35Upg4Qo7:x0rQ6L68YnH1UUpg4h7
Threatray 4'592 similar samples on MalwareBazaar
TLSH 0EC48915254C9CA7FBE0D7322896A3352123FB401C21DF5AEE776A3A5A233719B07D72
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: tenda.cn
Sending IP: 58.250.161.62
From: marketing@tenda.cn <marketing@tenda.cn>
Subject: RFQ 73210704
Attachment: RFQ 73210704.pdf.IMG (contains "PO7321.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO7321.exe
Verdict:
Malicious activity
Analysis date:
2021-04-08 07:23:34 UTC
Tags:
installer trojan formbook stealer
Link:
https://app.any.run/tasks/96db1276-1f4f-4a33-8026-33f15a7233ce

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133071/
Detection(s):
SecuriteInfo.com.Artemis774ECA4068DC.31277.22524.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a file
Sending a UDP request
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
DNS request
Sending an HTTP GET request
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/669654
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 383757 Sample: PO7321.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 33 www.lpp888.xyz 2->33 35 www.culvercoop.com 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 5 other signatures 2->49 11 PO7321.exe 18 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\Local\...\57cmo2.dll, PE32 11->31 dropped 59 Detected unpacking (changes PE section rights) 11->59 61 Maps a DLL or memory area into another process 11->61 63 Tries to detect virtualization through RDTSC time measurements 11->63 65 Contains functionality to prevent local Windows debugging 11->65 15 PO7321.exe 11->15         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 15->67 69 Maps a DLL or memory area into another process 15->69 71 Sample uses process hollowing technique 15->71 73 Queues an APC in another process (thread injection) 15->73 18 explorer.exe 15->18 injected process9 dnsIp10 37 yosapark-gakuenmae.com 169.56.29.200, 49752, 80 SOFTLAYERUS United States 18->37 39 www.torer.net 217.160.0.101, 49766, 80 ONEANDONE-ASBrauerstrasse48DE Germany 18->39 41 15 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 msdt.exe 18->22         started        25 autochk.exe 18->25         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 27 cmd.exe 1 22->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1/
Threat name:
Win32.PUA.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 07:05:16 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hklise3svblyvkyy24fdo7liu6k2wl4sytexyxyjq3l7cadesdiq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01476f904e668758ea516e84f359d6d0a4d85dadc179a51788a214ea46ff9dec
Formbook
1925c407d4f24ed0e1e002a57042e4cec58f9e09bde7c441f6f5b9ca5748ea20
Formbook
28f57adc56668022a2db544f26ea18b9015ca4ab414dd825eafc3e8c4b179c63
Formbook
63b94415ccf2fabff3be3a811ded9a5306d68ac197adc07d7c2be3b313e8a665
Formbook
7ec78d6c2c919a22185cb0000f2e273d66019b8409a3ca47c819d44cedead22e
Formbook
8412907b0441a1695b45e1de5e7b446d28ab00f6da416bdb2575f51eb60e9647
Formbook
bd6055810a703f4f0caec388c7cce89661ee9451179dc3abe6261480bda4105e
Formbook
c36c6fd8b9b9f444675b6c97fa1dfa2c2fa05aba6c0f6f4f164e0cf7d1e5bfc7
Formbook
cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
Formbook
fd0cf58b93453778c312805f74673284da2548389ee866c37cc91431f0ba9cb1
Formbook
+ 4'582 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210408-vnw8vxcw9j/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.013y.com/pnqr/
Unpacked files
SH256 hash:
c5adce72a02aafb28dab7c360b1f5555bdedfe1d9d97bda574b6d9d29377bda0
MD5 hash:
7418f8dc5479eeb371264cf36b4cf551
SHA1 hash:
40401572084a68334c508d98bf10aaa5a199bdc5
Link:
https://www.unpac.me/results/1432d7e0-b284-45d6-b390-645b00af8091/
SH256 hash:
3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1
MD5 hash:
774eca4068dce6d3db505c49af0a516e
SHA1 hash:
7708d1ed2bb3166bf74d0e92ac95bb8e379e1cf4
Link:
https://www.unpac.me/results/1432d7e0-b284-45d6-b390-645b00af8091/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.57
Link:
https://yomi.yoroi.company/submissions/3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img a5a579ad4c78746af5321fbf4ec5654679f428a99a692ad012ef90afb27745b6

Formbook

Executable exe 3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1

(this sample)

  
Dropped by
MD5 b3e8a410e9ffea0184b3fdb6665a335c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/133071/
  
Dropped by
SHA256 a5a579ad4c78746af5321fbf4ec5654679f428a99a692ad012ef90afb27745b6

Comments