MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e
SHA3-384 hash: 248978003b251532bca57d2e2b1894014e4467f77b2bc265dd72940364990c330f81819a3db74d45d95d34bb9e3a941a
SHA1 hash: 8485aaece36ba8858985a58740f5426eb817024c
MD5 hash: 9a72524dfcb8e021a894d265535e7561
humanhash: spring-nevada-king-music
File name:DOCX RFQ#4.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:628'736 bytes
First seen:2020-12-08 06:32:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:SHieje02jtY3QrZLk91/nRGTcWfWf4oK4h7yotiwgCamk3DLBxymfe:Ss02jtY3QrZLy/R9xf0how0kzLDyN
Threatray 3'159 similar samples on MalwareBazaar
TLSH 2DD4BE367E502EA3D6BECBF640203650CFB5662B296DE2CC6CC611DE45F6F104999E23
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DOCX RFQ#4.exe
Verdict:
Malicious activity
Analysis date:
2020-12-08 06:38:20 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/57aa4054-895f-48f6-96ed-e678d34c35ef

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/107152/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.6124.1682.26518.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Gathering data
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/557593
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 327890 Sample: DOCX RFQ#4.exe Startdate: 08/12/2020 Architecture: WINDOWS Score: 100 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected AntiVM_3 2->43 45 5 other signatures 2->45 10 DOCX RFQ#4.exe 3 2->10         started        process3 file4 29 C:\Users\user\AppData\...\DOCX RFQ#4.exe.log, ASCII 10->29 dropped 13 DOCX RFQ#4.exe 10->13         started        process5 signatures6 53 Modifies the context of a thread in another process (thread injection) 13->53 55 Maps a DLL or memory area into another process 13->55 57 Sample uses process hollowing technique 13->57 59 Queues an APC in another process (thread injection) 13->59 16 explorer.exe 13->16 injected process7 dnsIp8 31 asakitreks.com 92.42.109.119, 49767, 80 VELIANET-ASvelianetInternetdiensteGmbHDE Switzerland 16->31 33 www.houxinjian.com 154.213.248.39, 49765, 80 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 16->33 35 6 other IPs or domains 16->35 37 System process connects to network (likely due to code injection or exploit) 16->37 20 colorcpl.exe 16->20         started        23 autochk.exe 16->23         started        signatures9 process10 signatures11 47 Modifies the context of a thread in another process (thread injection) 20->47 49 Maps a DLL or memory area into another process 20->49 51 Tries to detect virtualization through RDTSC time measurements 20->51 25 cmd.exe 1 20->25         started        process12 process13 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-07 22:23:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
42
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mod4ery36nnqafupeiywpnrs6p5ehip52khc3zqo5ja73atve4pa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
013592f262bbf69d60ba1a3fe783e0cfce5470b114752148b267884d5993db44
Formbook
2829f8bf819c13d753f3c6b33726df8c46a533f3040b550a86ca0ab34f967e92
Formbook
45cf51569314dac91762e5c1f112c4a640595239d553729f10613f9f59403e84
Formbook
496312b0f2439d09765eb76ce146369b9417f59225f86c9b5f0ef8e1bb880602
Formbook
5d23faa05258eb51b196fee00263dc5e4556a37301d312563843a7ac8494ee19
Formbook
74ee80ac61ce369a23feac3296a825873aa257282d5dd0f9c35c385e3d6766cf
Formbook
911fec402f3bb42d731c4e177c322c0df8d79f680e5a18f538a3ff2e3086c2bf
Formbook
928c710fc7eaa23a9b84ab77dc39377dc4a0782e3482d8bbda505f955b37d2f8
Formbook
a9a6a44f3eca95cc7785debebea767461798f27978628c58a06474005b8855c8
Formbook
bd53fc041a6e364f163c70e2bcf38a1565f3764a31b8c94de466fce780f9ab71
Formbook
+ 3'149 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201208-1sbplbspj6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.evana-rohanihijab.com/iic6/
Unpacked files
SH256 hash:
6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e
MD5 hash:
9a72524dfcb8e021a894d265535e7561
SHA1 hash:
8485aaece36ba8858985a58740f5426eb817024c
Link:
https://www.unpac.me/results/95a9b1e6-dc63-4b52-b052-cfeaab5989ae/
SH256 hash:
c88a66cbf00b12c88e2b970b8bc220e970e8465e56098ced24e97d42be901b94
MD5 hash:
a60401dc02ff4f3250a749965097e13f
SHA1 hash:
3f22d28fd765f831084cb972a8bd071e421c26a1
Link:
https://www.unpac.me/results/95a9b1e6-dc63-4b52-b052-cfeaab5989ae/
SH256 hash:
6cb8970d317e5884b2d89ac311f63c8cb1d881a64ad4c64f40cae5af74238781
MD5 hash:
51cfd6eba82d31467aabb152ac981d07
SHA1 hash:
51e73b532169b51888c8ee482a9ab2fa4f388a1d
Link:
https://www.unpac.me/results/95a9b1e6-dc63-4b52-b052-cfeaab5989ae/
SH256 hash:
d3932b66f24a5c68ab031a48a259749133e2cc426b1ff774ba176de2ecac2f94
MD5 hash:
48c6f3b34b4fad3589c8cba5e3ccc569
SHA1 hash:
e0ef19475d98c19be74c47b09b2e2a30fc033f6f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/95a9b1e6-dc63-4b52-b052-cfeaab5989ae/
Parent samples :
928c710fc7eaa23a9b84ab77dc39377dc4a0782e3482d8bbda505f955b37d2f8
6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Reversed_Base64_Encoded_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an base64 encoded executable with reversed characters
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 51d12c355f49ee7c69c964cb2ae3b092845c99dff71146144d85529abd62f5c2

Formbook

Executable exe 6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 51d12c355f49ee7c69c964cb2ae3b092845c99dff71146144d85529abd62f5c2
Cape
Cape
https://www.capesandbox.com/analysis/107152/

Comments