MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 681b37be0d24067f1cb3b29fa998c9ff305841c53a686ac68c295f0784abf40e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 681b37be0d24067f1cb3b29fa998c9ff305841c53a686ac68c295f0784abf40e
SHA3-384 hash: cbecd230c561a3e4d7887dd527d29d9c93670ea4d8ea99231d0b07f5fd9db47353973a9c35169169e7e7031b87bf984e
SHA1 hash: 30081d4527048ebfb00616f9a00c0cb88edc322f
MD5 hash: a57631c7a721c2851ed89d1b00634d45
humanhash: oxygen-maryland-batman-cola
File name:moses.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:592'635 bytes
First seen:2020-11-05 11:44:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 12288:vanj0IynrRwmm1GzMXhm2IO3QWWFHKMUeehFYtq8SR6ICB7+px8NpZk2c:Ynya1rECARFHK/eehFmU3CBiIbk7
Threatray 3'038 similar samples on MalwareBazaar
TLSH 27C4234AD219F816C8FC0DB1A9B117694F99E866090B0107379CFC94B17B92B5F1E3AF
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83240/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Creating a file
Launching a process
Forced shutdown of a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/521389
Signature
Hijacks the control flow in another process
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 309793 Sample: moses.exe Startdate: 05/11/2020 Architecture: WINDOWS Score: 100 40 www.missusmagpie.com 2->40 56 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 3 other signatures 2->62 12 moses.exe 62 2->12         started        signatures3 process4 file5 32 C:\Users\user\AppData\...\PuppetBedouin.dll, PE32 12->32 dropped 34 C:\Users\user\AppData\...\vdtflavuil.dll, PE32 12->34 dropped 36 C:\Users\user\AppData\...\spcustom.dll, PE32 12->36 dropped 38 9 other files (none is malicious) 12->38 dropped 15 rundll32.exe 12->15         started        process6 signatures7 72 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 15->72 74 Hijacks the control flow in another process 15->74 76 Maps a DLL or memory area into another process 15->76 18 cmd.exe 15->18         started        process8 signatures9 48 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 18->48 50 Modifies the context of a thread in another process (thread injection) 18->50 52 Maps a DLL or memory area into another process 18->52 54 3 other signatures 18->54 21 explorer.exe 18->21 injected process10 dnsIp11 42 shops.myshopify.com 23.227.38.64, 49752, 80 CLOUDFLARENETUS Canada 21->42 44 www.sustainableroadtrips.com 21->44 46 www.kobelojaonline.com 21->46 64 System process connects to network (likely due to code injection or exploit) 21->64 25 help.exe 21->25         started        signatures12 process13 signatures14 66 Modifies the context of a thread in another process (thread injection) 25->66 68 Maps a DLL or memory area into another process 25->68 70 Tries to detect virtualization through RDTSC time measurements 25->70 28 cmd.exe 1 25->28         started        process15 process16 30 conhost.exe 28->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/681b37be0d24067f1cb3b29fa998c9ff305841c53a686ac68c295f0784abf40e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 05:17:46 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nantppqneqdh6hftwkp2tggj74yfqqofhjugvrumffpqpbfl6qha._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0e661b488a5571afb39ddf31bda089f7c032ed0a077501c3b7c8a31a0a6442d6
Formbook
2cc0ceea32e11e6a3e25097f9628105a81d641a7333e1e15678fac797f4e7abe
Formbook
3a10c525b2f0a94e7e9facfa4685490e9a46d0d6a62be53f570fa845cd680c56
Formbook
414578aa9e1ab74c43ae636f64758a5a2dd59ab81619aa054de1fb6c9140f2e6
Formbook
5d9004bb38a2e4c6ee1528f75e8453e778d9f39a3e7d9f02ee7821eae65cf886
Formbook
6847d25820be1a4d252df58d3652e103f33af5a43f12febeae71ac66385b0380
Formbook
8a1f8815b2d54f7171358001bec7be97d87660a29d8bce9d247da901b012f594
Formbook
a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b
Formbook
cfd29866a9e618985b15c779e0ac0ad8e09a9e997774c0d2fe18f00f8110a24a
Formbook
ebd88634ecfbdc7e88bca32a0b22fa35e24c9feb309799128f3d12d2cceac224
Formbook
+ 3'028 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201105-q6lnvrrjtx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.lightmeets.com/c237/
Unpacked files
SH256 hash:
681b37be0d24067f1cb3b29fa998c9ff305841c53a686ac68c295f0784abf40e
MD5 hash:
a57631c7a721c2851ed89d1b00634d45
SHA1 hash:
30081d4527048ebfb00616f9a00c0cb88edc322f
Link:
https://www.unpac.me/results/b0201956-dcca-45c5-a414-35261603b2a3/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 681b37be0d24067f1cb3b29fa998c9ff305841c53a686ac68c295f0784abf40e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/83240/

Comments