MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506
SHA3-384 hash: dcc822e941b51aebe12ecdc1e283464b16a70c4de7969673e1fdd4f5eb3656ad0328242b6a895be34f7efea334a4cb41
SHA1 hash: d1a0ad8fe1c1adc9d27b5ceb3d7d27c9512c5495
MD5 hash: 373529da43706b9b230586b501a000fd
humanhash: california-kentucky-happy-leopard
File name:Payment - Swift Copy.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:899'584 bytes
First seen:2020-11-26 07:15:25 UTC
Last seen:2020-11-27 14:10:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:dIsBP2xaQXT5zPvEOFlzUn/D7KOoIarOVGmM8DMnFOf/7xLjhab+1z7sBWqZCg3V:OuPx85LvEUlo/KO/gmovFC7xL1o
Threatray 3'059 similar samples on MalwareBazaar
TLSH CC154B5B334873DECA5AADF1D8201C7ABA50A922431FE25BCDD35C9A9F0D45ACE341E1
Reporter cocaman
Tags:exe FormBook SWIFT

Intelligence

File Origin
# of uploads :
3
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Gathering data
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/547836
Signature
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 323021 Sample: Payment - Swift Copy.exe Startdate: 26/11/2020 Architecture: WINDOWS Score: 100 33 g.msn.com 2->33 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected AntiVM_3 2->45 47 6 other signatures 2->47 11 Payment - Swift Copy.exe 3 2->11         started        signatures3 process4 file5 31 C:\Users\...\Payment - Swift Copy.exe.log, ASCII 11->31 dropped 57 Injects a PE file into a foreign processes 11->57 15 Payment - Swift Copy.exe 11->15         started        18 Payment - Swift Copy.exe 11->18         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 15->59 61 Maps a DLL or memory area into another process 15->61 63 Sample uses process hollowing technique 15->63 65 Queues an APC in another process (thread injection) 15->65 20 explorer.exe 15->20 injected process9 dnsIp10 35 www.hagisiran.space 183.181.82.161, 49736, 80 VECTANTARTERIANetworksCorporationJP Japan 20->35 37 www.twobluemagpies.com 94.136.40.51, 49729, 80 GD-EMEA-DC-LD5GB United Kingdom 20->37 39 2 other IPs or domains 20->39 49 System process connects to network (likely due to code injection or exploit) 20->49 24 explorer.exe 20->24         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 24->51 53 Maps a DLL or memory area into another process 24->53 55 Tries to detect virtualization through RDTSC time measurements 24->55 27 cmd.exe 1 24->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 07:16:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhsanb5nd75xxjer3ewnhazt2puwye2lu5zz3tot5dxc5inrsuda._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
6bdd742fd2995cf633d3d99d0d3bc3f398ff3e18775b1de3370427256ffccd61
Formbook
805024bdbd61ad0a7a280c42f98c89da5563c2498ed768971ddc74dca126e591
Formbook
95deccdc9ef87962793e87e162d62c1d07c56dbae3b964d93e79c190f38183f7
Formbook
ac4d58dc0ca5617911f7ff52953cec2eac9249963dbce3b2f682aeb6eb1baa77
Formbook
b3420cc90cce972045db0377a5c383ce049652650946b0c84f27280a7dbd1e38
Formbook
bbb95e154a42908b2bbb1797d8b6178343b7c084158183f628b5c4bf3fe5ac7d
Formbook
cecc7bc9b39a859e18945a6c8528af86b9d74a20ca74cd629ef03afdc6ab08a4
Formbook
d11ae1d5e09d63aa386479af620faf3b9053d12e6d3a8a1353aba274fef2153e
Formbook
d8eca36ecff579ceffbd778ab8c8949a94d4967e1c0965988b2a68671f1915ef
Formbook
e6d2c97461c6aac9ea130eaa96f9927b57998c04b5e7573a555caa729178a70c
Formbook
+ 3'049 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201126-83p6vypksx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.danneroll.com/mnc/
Unpacked files
SH256 hash:
49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506
MD5 hash:
373529da43706b9b230586b501a000fd
SHA1 hash:
d1a0ad8fe1c1adc9d27b5ceb3d7d27c9512c5495
Link:
https://www.unpac.me/results/28fe0e84-2ed0-4bb2-af2f-05e5f1f3f5c6/
SH256 hash:
b7b87af87a4878269f08b0ebd0f698e4dfbeb3c259b020557ff2621c603d7e6c
MD5 hash:
088f43594e090de78f0f1d427e9c0cff
SHA1 hash:
a7cd24e8f20ba5f42af8245f2e41130570faa703
Link:
https://www.unpac.me/results/28fe0e84-2ed0-4bb2-af2f-05e5f1f3f5c6/
SH256 hash:
a3a008b87ded765ed76c9bedd06dbae5f62edd573da15d376cb3fb91b4bd7f09
MD5 hash:
5ae25f51e2881f74cc9e057ef48c02a6
SHA1 hash:
a8e9e48e0e788e76ce01e923946bfb0c2098b39c
Link:
https://www.unpac.me/results/28fe0e84-2ed0-4bb2-af2f-05e5f1f3f5c6/
SH256 hash:
c8a45fbbf499d766d4e6490ddb4cbacd4e75389e13a316852246cf2bee08216e
MD5 hash:
32579965abcb80d4bd3f19c0515c773b
SHA1 hash:
fcd952827774f76ea11ade9be1ef21c12218092d
Link:
https://www.unpac.me/results/28fe0e84-2ed0-4bb2-af2f-05e5f1f3f5c6/
SH256 hash:
76239076207b78fdfd629be2b5c418022172793776675c882f5190db54466d5f
MD5 hash:
2e1683c0bf7883418c50740fd8146390
SHA1 hash:
9ef2be61c4b795dd1bbc1377b68068e347295640
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/28fe0e84-2ed0-4bb2-af2f-05e5f1f3f5c6/
Parent samples :
95deccdc9ef87962793e87e162d62c1d07c56dbae3b964d93e79c190f38183f7
49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506
0a2fe4b7d0c23f0ea83a75f458660dfd486d336716609bda19c82a05730ff4d3
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar bc881445f45070601925167f73ab679e0528413fa5d216f3adc5b37fa3b88cbc

Formbook

Executable exe 49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 bc881445f45070601925167f73ab679e0528413fa5d216f3adc5b37fa3b88cbc
Cape
Cape
https://www.capesandbox.com/analysis/105615/

Comments