MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d712492e99881e2d59608153262e30b2f6799a1bc37c22a4195994eea72f81a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d712492e99881e2d59608153262e30b2f6799a1bc37c22a4195994eea72f81a
SHA3-384 hash: 75e6de69fdeab0502d6a41767699c427d2b23e60fc4c310142655310c002efe132aa960c47f686a4b702c2f6d8a5940f
SHA1 hash: 3859795451b4c7772185f9d9f8c8201d9bd67057
MD5 hash: cb1b8f388d0d021150f2744304a580fb
humanhash: neptune-undress-beer-lima
File name:ATLAS AL SHARQ TRADING EST - PRODUCTS LIST.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'384'960 bytes
First seen:2021-06-30 12:25:08 UTC
Last seen:2021-06-30 19:09:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:sqOQbuBbX5TyM4y2pt+4y2ptToNBto+eoXS5dca0nWKCt+l2pszmhUJ+vtRFuSp0:aQyayoyDNBtWjdcuKCUosKdOn
Threatray 6'032 similar samples on MalwareBazaar
TLSH 8E558C10B9849528D87A8F3D5AB6C824577EBD677E32DC1C38F933AA0B73693847114B
Reporter malwarelabnet
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ATLAS AL SHARQ TRADING EST - PRODUCTS LIST.exe
Verdict:
Malicious activity
Analysis date:
2021-06-30 12:28:26 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/1074359c-d1cd-411c-aa4e-b08fcf31f699

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.17652.9764.10587.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7357cb55-8e0d-4875-b184-448080d3bbd5
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/809937
Signature
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses netstat to query active network connections and open ports
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 442348 Sample: ATLAS AL SHARQ TRADING EST ... Startdate: 30/06/2021 Architecture: WINDOWS Score: 100 31 clientconfig.passport.net 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 9 other signatures 2->45 11 ATLAS AL SHARQ TRADING EST - PRODUCTS LIST.exe 3 2->11         started        signatures3 process4 file5 29 ATLAS AL SHARQ TRA...ODUCTS LIST.exe.log, ASCII 11->29 dropped 57 Injects a PE file into a foreign processes 11->57 15 ATLAS AL SHARQ TRADING EST - PRODUCTS LIST.exe 11->15         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 15->59 61 Maps a DLL or memory area into another process 15->61 63 Sample uses process hollowing technique 15->63 65 Queues an APC in another process (thread injection) 15->65 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.scxqs.com 156.245.146.77, 49742, 80 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 18->33 35 www.kstransportationllc.com 18->35 37 kstransportationllc.com 34.102.136.180, 49747, 80 GOOGLEUS United States 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 49 Uses netstat to query active network connections and open ports 18->49 22 NETSTAT.EXE 18->22         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4d712492e99881e2d59608153262e30b2f6799a1bc37c22a4195994eea72f81a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-30 05:41:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
73
AV detection:
27 of 41 (65.85%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jvysjexjtca6fvmwbakteyxdbmxwpgnbxq34eksbswmu52ts7ana._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
19fea0b558bc85df1bec0bd5a086fd2678767117999762731b0f6fe15e1c590a
Formbook
3009ff9d8a1675709ccb395bb2c45fb0046a19389e37f4e20bc672efee49f8cd
Formbook
4fda1896f5143497af8231a4a73f99381038088aad02e30141d5be3322bcabeb
Formbook
53a4affbe5f5bdcecbe8e78d86d7e0603fa1b674a7269dce0997dc1d5ca8188a
Formbook
74743d6468cedf3e66f1171ef32981dca4fb211b3fd7be519045fc42b077ced2
Formbook
932d535ab92b682eff0f74322211abd760021a9003d18b953e7226a6ebc38902
Formbook
9b7fd781016675bd73b0acc7e402bbdcf4dfa3e3df4a5dd7d7c9c850bc2d85e8
Formbook
a227cf3f5fb90a859db6b3a95e95ead7b01dc01615de5433710205c6cd58ec78
Formbook
d885a2034e825199486fbe2eecbf1098e07c8ba36ffe3cca2518e3f332c48f28
Formbook
e242d70710f47daf819f4dec74264d265efd80a1aa12eec27c0ac20715670923
Formbook
+ 6'022 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210630-rywk2lk4qa/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.solegarage.com/bgmi/
Unpacked files
SH256 hash:
1723f07572dc98747d10201b0b44603bacd3de72c6aa0dea36bed463c14bdd3c
MD5 hash:
3da108f0c45edcab8b599274b4e998b2
SHA1 hash:
736303da7183e14ccc402d97819b54586e11568a
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/7b79da24-48ea-41ad-a783-bbb82030b648/
Parent samples :
4d712492e99881e2d59608153262e30b2f6799a1bc37c22a4195994eea72f81a
3506ed727e44f3c97a0b9eb31f6c9d06d44c84fc4898e7f65d4d1cede84a2e00
e753ebc9d17166f3c6e9df8201bb4a904c138673966c4c917fd54e4c44a43b66
SH256 hash:
1c5e0a0d909d1da24af87967a1e154c8aa490a1f99c6624e7214d20eb84f4fec
MD5 hash:
81faf15c7e3c9446d906659f7c7a9f16
SHA1 hash:
d7e05a22b109ce608109dc509029a7fe22b4b8bf
Link:
https://www.unpac.me/results/7b79da24-48ea-41ad-a783-bbb82030b648/
SH256 hash:
00222a4003a7e5f9e0c47b8a8e032f2a3470dbf8f03201535987bd11a3d05472
MD5 hash:
07e7a74c2092ea67b1763a0d024deca4
SHA1 hash:
042d2ce235be9606b201597a34e32e60e70ab3bb
Link:
https://www.unpac.me/results/7b79da24-48ea-41ad-a783-bbb82030b648/
SH256 hash:
4d712492e99881e2d59608153262e30b2f6799a1bc37c22a4195994eea72f81a
MD5 hash:
cb1b8f388d0d021150f2744304a580fb
SHA1 hash:
3859795451b4c7772185f9d9f8c8201d9bd67057
Link:
https://www.unpac.me/results/7b79da24-48ea-41ad-a783-bbb82030b648/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/4d712492e99881e2d59608153262e30b2f6799a1bc37c22a4195994eea72f81a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments