MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 601832be346d3c348f20841847a679b4888006f7f8e062a8c3c581f1ea0eac52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 601832be346d3c348f20841847a679b4888006f7f8e062a8c3c581f1ea0eac52
SHA3-384 hash: c2410e5c6eb34fdda953503c693f47caf5b08aa37acd75c498566f778d60a744210365673684685e323e4fdd9cf54cd9
SHA1 hash: ef328e4c0f6b2faa93db0f67d783df3f2b76f003
MD5 hash: 93345abd36f1ca4566ed821904c8cada
humanhash: orange-carbon-comet-juliet
File name:93345abd36f1ca4566ed821904c8cada.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'223'168 bytes
First seen:2021-02-02 08:49:17 UTC
Last seen:2021-02-02 12:18:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:kIu8Y6DZWlE327vQZGCIdNXrfWJ0/9GKaDI8u:kIu8Y6glE327oGBNLWkAaN
Threatray 177 similar samples on MalwareBazaar
TLSH 0745FDA2F3689E4CEC64F7B656DAA27C9392F4F796948E4317094B7113B30F1E84D488
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
93345abd36f1ca4566ed821904c8cada.exe
Verdict:
Suspicious activity
Analysis date:
2021-02-02 08:50:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/689bcdab-470d-4208-84d8-5d2ac954ee1e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115089/
Detection(s):
SecuriteInfo.com.Artemis93345ABD36F1.21243.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/596378
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 347228 Sample: 8foMX5QfDT.exe Startdate: 02/02/2021 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 4 other signatures 2->44 10 8foMX5QfDT.exe 3 2->10         started        process3 file4 30 C:\Users\user\AppData\...\8foMX5QfDT.exe.log, ASCII 10->30 dropped 54 Tries to detect virtualization through RDTSC time measurements 10->54 56 Hides that the sample has been downloaded from the Internet (zone.identifier) 10->56 58 Injects a PE file into a foreign processes 10->58 14 8foMX5QfDT.exe 10->14         started        signatures5 process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 14->60 62 Maps a DLL or memory area into another process 14->62 64 Sample uses process hollowing technique 14->64 66 Queues an APC in another process (thread injection) 14->66 17 explorer.exe 14->17 injected process8 dnsIp9 32 niasmasterclass2020.com 144.76.225.149, 49765, 80 HETZNER-ASDE Germany 17->32 34 999ak.namebbb123.com 104.255.229.20, 49764, 80 CNSERVERSUS United States 17->34 36 5 other IPs or domains 17->36 46 System process connects to network (likely due to code injection or exploit) 17->46 21 colorcpl.exe 17->21         started        24 autochk.exe 17->24         started        signatures10 process11 signatures12 48 Modifies the context of a thread in another process (thread injection) 21->48 50 Maps a DLL or memory area into another process 21->50 52 Tries to detect virtualization through RDTSC time measurements 21->52 26 cmd.exe 1 21->26         started        process13 process14 28 conhost.exe 26->28         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/601832be346d3c348f20841847a679b4888006f7f8e062a8c3c581f1ea0eac52/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-02 08:22:03 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  1/5
Verdict:
unknown
Similar samples:
3d9b59ef7e396dcbfbb58069b1876d6b85e111c7e36b6a302cf4e955fb711a29
Formbook
55ca4147c94a10c9fc3fe95d3e922546ee796f63ca3b9aad005998f1e1e2b912
Formbook
6676e9557ed6b68ca5919a7025e82f33fc0939914e26130953b29c3cf8981474
Formbook
7ed52ad664825ac1786dd750f086f18e2be484245c9a3f3cb51bdce8fa84aa5f
Formbook
842cda0e7609203f715a06b9eb524bd82593ad4dfc4d5cc1c7754cff47ccda29
Formbook
8dcbe6a1627356b6707223af14e34eaf6b9fde0c9781707b2fb6de4c9b12a742
Formbook
adf3f47687c15c048c4c909e95c5c2c17187259832ebbab51b6a0b2c5e5f588e
Formbook
c7a2fcc718b3adeedee6e215f17799f22662a66c5c8e08af94ea641e9e909b8d
Formbook
cd63e20a002279934bc2ed4887d77605686a79f28f8114f9c01b678754a1e10a
Formbook
d21f7c6f8a4fbbb00973d1ed40f4c9ca33920aaca079b70ff298db4e74b56134
Formbook
+ 167 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210202-8d6nzk82qn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.silkcitytrade.com/oze/
Unpacked files
SH256 hash:
c06d4e3d0205d9bdd4a4b40b8da710d698b3a5d73a1626c9ca058c10b2c6d00c
MD5 hash:
7f67414b3fd29299f2d29ad7c2afb995
SHA1 hash:
2ec40d57c08c47433a6d044d271d74005dddae8d
Link:
https://www.unpac.me/results/561d61e7-ecc5-45eb-a9b8-26a3be09f503/
SH256 hash:
4f81e273da20c5b9835ce6ca57cc061d77764f9e3927bdb1505cb791bf50b046
MD5 hash:
29e19b5dce96140a8b90152b16bd44af
SHA1 hash:
4f3dc6eb876bb58f53966980a9c451a04ec17d8a
Link:
https://www.unpac.me/results/561d61e7-ecc5-45eb-a9b8-26a3be09f503/
SH256 hash:
e2b5646e959fcf2f6ed994780262e65c16cecbc9d3421ada3239f26130ebe8d1
MD5 hash:
7a13d5b7628956f87cb4f24b3e66ff5d
SHA1 hash:
5a2a3e4a70a7ef67180b6dea2273c9c3ae162f9c
Link:
https://www.unpac.me/results/561d61e7-ecc5-45eb-a9b8-26a3be09f503/
SH256 hash:
a60900adc31e8e28ff541b91a55de5d9719c0d1ddc3022eb6f6fb5ac19cc9e4f
MD5 hash:
831fb0609b3509b4fb31ac662ac69217
SHA1 hash:
985c33fa2b01e305995e2ea166b961b01f0f6335
Link:
https://www.unpac.me/results/561d61e7-ecc5-45eb-a9b8-26a3be09f503/
SH256 hash:
bc83889f11bce499a475471dc6d9ad797ae46752a35ca879b9677dc30519b8af
MD5 hash:
73224391fee1d64f4aee6281a200c805
SHA1 hash:
fac7de9dfd1af84d36e5f692b50f949db64375ab
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/561d61e7-ecc5-45eb-a9b8-26a3be09f503/
SH256 hash:
601832be346d3c348f20841847a679b4888006f7f8e062a8c3c581f1ea0eac52
MD5 hash:
93345abd36f1ca4566ed821904c8cada
SHA1 hash:
ef328e4c0f6b2faa93db0f67d783df3f2b76f003
Link:
https://www.unpac.me/results/561d61e7-ecc5-45eb-a9b8-26a3be09f503/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/601832be346d3c348f20841847a679b4888006f7f8e062a8c3c581f1ea0eac52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 601832be346d3c348f20841847a679b4888006f7f8e062a8c3c581f1ea0eac52

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/115089/
  
URLhaus
https://urlhaus.abuse.ch/url/987601/
  
Delivery method
Distributed via web download

Comments