MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f3daa13de0dde36e87f536f9cbcabc3170a6ddc4bd261d8ad3d3cd8515f6790. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f3daa13de0dde36e87f536f9cbcabc3170a6ddc4bd261d8ad3d3cd8515f6790
SHA3-384 hash: de09e378c5147ccbff6df071b31b434ddd55d3317d8f731e22ceca35cbe8ac1871c9f32c624020f6d4cf7b75be4d8b59
SHA1 hash: a52637fe73a943fa9afb6623927e65be4d00a0d1
MD5 hash: 7cc9466430591d8c46293c09e287ae8b
humanhash: magnesium-twenty-mirror-mississippi
File name:đơn hàng mới.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:577'536 bytes
First seen:2020-10-26 08:58:10 UTC
Last seen:2020-10-26 11:23:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:JtJADHVuB+sVp/RRdmQ9Brgl6o/i57Hrllhh7izkHZBMMGeSRlmsfXa9C:eDHEZRdmQ9BK6oq57HhlhdHbMMGeSRYd
TLSH 7DC4D022728C9742E13D87B84421D03057F5BC8ADB32E519BEE47ADF31B2E858E66717
Reporter abuse_ch
Tags:exe FormBook geo VNM


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: server.freespirittours.net
Sending IP: 216.144.241.158
From: Tiền Hana <exports@plazaforwarding.com>
Subject: Re: Re: yêu cầu báo giá
Attachment: đơn hàng mới.zip (contains "đơn hàng mới.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/78869/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.16597.28045.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Windows subdirectories
Sending a UDP request
Creating a file
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/511422
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 304853 Sample: #U0111#U01a1n h#U00e0ng m#U... Startdate: 26/10/2020 Architecture: WINDOWS Score: 100 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for dropped file 2->46 48 Sigma detected: Scheduled temp file as task from temp location 2->48 50 9 other signatures 2->50 10 #U0111#U01a1n h#U00e0ng m#U1edbi.exe 8 2->10         started        process3 file4 34 C:\Users\user\AppData\...\UGYAmFHfNYHAp.exe, PE32 10->34 dropped 36 C:\Users\user\AppData\Local\...\tmp12F4.tmp, XML 10->36 dropped 54 Writes to foreign memory regions 10->54 56 Allocates memory in foreign processes 10->56 58 Injects a PE file into a foreign processes 10->58 14 RegSvcs.exe 10->14         started        17 RegSvcs.exe 10->17         started        19 schtasks.exe 1 10->19         started        signatures5 process6 signatures7 66 Modifies the context of a thread in another process (thread injection) 14->66 68 Maps a DLL or memory area into another process 14->68 70 Sample uses process hollowing technique 14->70 72 Queues an APC in another process (thread injection) 14->72 21 explorer.exe 14->21 injected 74 Tries to detect virtualization through RDTSC time measurements 17->74 25 conhost.exe 19->25         started        process8 dnsIp9 38 www.shestakova.info 188.225.28.247, 49738, 80 TIMEWEB-ASRU Russian Federation 21->38 40 www.deanpalm.net 208.91.197.27, 49736, 80 CONFLUENCE-NETWORK-INCVG Virgin Islands (BRITISH) 21->40 42 3 other IPs or domains 21->42 52 System process connects to network (likely due to code injection or exploit) 21->52 27 rundll32.exe 21->27         started        signatures10 process11 signatures12 60 Modifies the context of a thread in another process (thread injection) 27->60 62 Maps a DLL or memory area into another process 27->62 64 Tries to detect virtualization through RDTSC time measurements 27->64 30 cmd.exe 1 27->30         started        process13 process14 32 conhost.exe 30->32         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3f3daa13de0dde36e87f536f9cbcabc3170a6ddc4bd261d8ad3d3cd8515f6790/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-25 23:43:52 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h462ue66bxpdn2d7knxzzpflymlqu3o4jpjgdwfnhu6nquk7m6ia._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201026-xvl31xx82n/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.kumcal.com/fs8/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 13fefbf8cc7c2e6906113769b3cec6c15b9a3b34a18be54e7c4097e76de63c35

Formbook

Executable exe 3f3daa13de0dde36e87f536f9cbcabc3170a6ddc4bd261d8ad3d3cd8515f6790

(this sample)

  
Dropped by
MD5 4aab68a4fdcbfdf085e20bc26829a7e8
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 13fefbf8cc7c2e6906113769b3cec6c15b9a3b34a18be54e7c4097e76de63c35
Cape
Cape
https://www.capesandbox.com/analysis/78869/

Comments