MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 679ce1d895289ba4b92a72e1e1c00d3698395afcbe99474308092cb3cf4272fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 679ce1d895289ba4b92a72e1e1c00d3698395afcbe99474308092cb3cf4272fc
SHA3-384 hash: f72fbcec85c1d804b7900f9cddf1c769e962527055af2e85586a3d8839f6bc2ef59c5af9657e2804b4508bf8b6458f78
SHA1 hash: 4c26d8ab75ffbb1940577c3e6ad3b2594f985dab
MD5 hash: 2db12a6571e126182d708fb08fb0199c
humanhash: equal-bravo-ceiling-nitrogen
File name:Payment Copy#513.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'639'936 bytes
First seen:2021-05-14 07:16:28 UTC
Last seen:2021-05-14 07:48:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:9c1OAnTWxGfyDeNLc8XYFI2aywdl7N9zDsMPlbcOWcTo:9c13axGVLc8XYOy+l7DzDZprX
Threatray 1'900 similar samples on MalwareBazaar
TLSH 327539ADF7A4BFD6E41D4F378103415883F4806373B2F6AF29E11AE10651B898E1F5A6
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment Copy#513.exe
Verdict:
Malicious activity
Analysis date:
2021-05-14 07:25:06 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/3d91690b-cad5-406e-aaed-2c46f1939466

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/156456/
Detection(s):
SecuriteInfo.com.Artemis2DB12A6571E1.19193.23415.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending a UDP request
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/781662
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 414058 Sample: Payment Copy#513.exe Startdate: 14/05/2021 Architecture: WINDOWS Score: 100 33 www.santamonicaboatrental.com 2->33 35 www.arissshop.com 2->35 37 2 other IPs or domains 2->37 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 6 other signatures 2->51 11 Payment Copy#513.exe 15 4 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 11->29 dropped 31 C:\Users\user\...\Payment Copy#513.exe.log, ASCII 11->31 dropped 63 Writes to foreign memory regions 11->63 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->65 67 Injects a PE file into a foreign processes 11->67 15 AddInProcess32.exe 11->15         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 15->69 71 Maps a DLL or memory area into another process 15->71 73 Sample uses process hollowing technique 15->73 75 2 other signatures 15->75 18 explorer.exe 15->18 injected process9 dnsIp10 39 www.dijcan.com 91.204.46.142, 49731, 80 NETCUP-ASnetcupGmbHDE Germany 18->39 41 www.futureplus.net 64.190.62.111, 49737, 80 NBS11696US United States 18->41 43 10 other IPs or domains 18->43 53 System process connects to network (likely due to code injection or exploit) 18->53 55 Performs DNS queries to domains with low reputation 18->55 22 svchost.exe 18->22         started        signatures11 process12 signatures13 57 Modifies the context of a thread in another process (thread injection) 22->57 59 Maps a DLL or memory area into another process 22->59 61 Tries to detect virtualization through RDTSC time measurements 22->61 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/679ce1d895289ba4b92a72e1e1c00d3698395afcbe99474308092cb3cf4272fc/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-14 07:17:09 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6oodwevfcn2jojkolq6dqang2mdswx4x2muoqyibewlht2col6a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0b755a23b31f709cdcd39b195d0bd4d50b049bd869b1db57892fb94878992760
Formbook
0fa8114ac4b5c4ff6727117699cb2f702be6cf0a6c54ad147fefc1620f32f6aa
Formbook
914c79c23d30b4df795779800b6e14ac42bec2dc618d11d7c0b526960fc6283c
Formbook
999813d0bce8eb3dd4057bb0535d1ce571c272a3ac60264d4a4ecc28f7644875
Formbook
a677db1e19ef0ff96a19fb973e8505296ca98d69c2eb7f97c18f097b6786f9b7
Formbook
a86f792a5a3d424b756508cb462d3ca9b454f2513a5471df5d41da33649748e9
Formbook
b0cb75ec80235b836d03b9dc5d5c0869f01e914f558803db9c15ad978c033dd1
Formbook
b1cd69c48573c38bbdcd957962221e6d14ebe9e1221e9c05b3c4460c4e5f5204
Formbook
d1c5fc3919d75c03db6df503ba210900921351ee1bbeb45c7a435ac5671c3a9e
Formbook
ec744aeae689c95f44a24eb398e65c3a722595de5504db84b2e41488f30a7510
Formbook
+ 1'890 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210514-1rpnk6dt6e/
Behaviour
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/156456/

Comments