MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49609c0487ceeec0771547efd9277b01f494be83549bc0245330672ee962c50c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49609c0487ceeec0771547efd9277b01f494be83549bc0245330672ee962c50c
SHA3-384 hash: 550ad8d2e4d44054a688959ca3e2b2dcb8efd32df88e1c5049448cbdde6346e1fc0c77ba8c231bd413e6663754a56b86
SHA1 hash: 51ceb5fb8e95c355ee3482e3d3f2c5d678203912
MD5 hash: d13b3ff3dfdab0ced5ea88729756afd6
humanhash: summer-foxtrot-lamp-item
File name:PO 800A3E4.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:985'930 bytes
First seen:2021-10-25 09:17:10 UTC
Last seen:2021-10-26 06:42:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4688138aa56f51df0a1bf9af39c02fc8 (4 x Formbook, 2 x BitRAT, 1 x SpectreRAT)
ssdeep 6144:1rvbp65i101f72CZvota4g42XcgOA+sXdq0nbE/lJemeMNUGF6TU9n+DZU8B:1POf72eota4g42XiAjibNUS0k+DV
TLSH T16225B403BEC53A55C1C32AB0065AE938B6611A22141E9F577F6BCE11DAB1F4395F83F4
File icon (PE):PE icon
dhash icon cc74647470707569 (8 x Formbook, 1 x SpectreRAT, 1 x BitRAT)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/199859/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Reading critical registry keys
Setting browser functions hooks
Possible injection to a system process
Unauthorized injection to a system process
Deleting of the original file
Unauthorized injection to a browser process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6176a389a9d585e6d537181c/reports/f8e7887a-3cd4-43e6-adf9-736ebecd8751/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2c583d68-4e18-451b-97ef-77a3ac3e68b0
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/876133
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Sigma detected: CMSTP Execution Process Creation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 508562 Sample: PO 800A3E4.exe Startdate: 25/10/2021 Architecture: WINDOWS Score: 100 34 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->34 36 Found malware configuration 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 6 other signatures 2->40 10 PO 800A3E4.exe 2->10         started        process3 process4 12 PO 800A3E4.exe 10->12         started        signatures5 50 Modifies the context of a thread in another process (thread injection) 12->50 52 Maps a DLL or memory area into another process 12->52 54 Sample uses process hollowing technique 12->54 56 Queues an APC in another process (thread injection) 12->56 15 explorer.exe 12->15 injected process6 dnsIp7 26 num5.17986.net 67.21.93.232, 49810, 80 ST-BGPUS United States 15->26 28 www.analytico-australis.com 44.227.65.245, 49840, 80 AMAZON-02US United States 15->28 30 4 other IPs or domains 15->30 32 System process connects to network (likely due to code injection or exploit) 15->32 19 cmstp.exe 15->19         started        signatures8 process9 signatures10 42 Self deletion via cmd delete 19->42 44 Modifies the context of a thread in another process (thread injection) 19->44 46 Maps a DLL or memory area into another process 19->46 48 Tries to detect virtualization through RDTSC time measurements 19->48 22 cmd.exe 1 19->22         started        process11 process12 24 conhost.exe 22->24         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49609c0487ceeec0771547efd9277b01f494be83549bc0245330672ee962c50c/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-10-25 09:18:06 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jfqjybehz3xma5yvi7x5sj33ah2jjpudksn4ajctgbts52lcyuga._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:c249 rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/211025-k9l38sghap/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.sarahnicolenadler.online/c249/
Unpacked files
SH256 hash:
d891d36ec5a49a0db8463d6030167b5be61fed4b8f54df11b71ff627b0ae62ca
MD5 hash:
176430f0c4f12e36ba2b0582c27aad60
SHA1 hash:
9f2adb7439704f7b0859dc1653d598174b0f7e61
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/7b675925-139f-4eda-9520-45e6a5533e57/
SH256 hash:
49609c0487ceeec0771547efd9277b01f494be83549bc0245330672ee962c50c
MD5 hash:
d13b3ff3dfdab0ced5ea88729756afd6
SHA1 hash:
51ceb5fb8e95c355ee3482e3d3f2c5d678203912
Link:
https://www.unpac.me/results/7b675925-139f-4eda-9520-45e6a5533e57/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/49609c0487ce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.69
Link:
https://yomi.yoroi.company/submissions/49609c0487ceeec0771547efd9277b01f494be83549bc0245330672ee962c50c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 49609c0487ceeec0771547efd9277b01f494be83549bc0245330672ee962c50c

(this sample)

  
Dropped by
formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/199859/

Comments