MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a25765e7d969b6c324cc461b08d947d49204191d97f620b4a74ba0f6dc744ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a25765e7d969b6c324cc461b08d947d49204191d97f620b4a74ba0f6dc744ca
SHA3-384 hash: ff16fde04617c6a2c057705ec88d05f32f1ae45abc484e6f86f5c6c14d7078f3e16412be226f48288389046cb9e883b6
SHA1 hash: c6a305733bc47dc26cd3e17de2375112d165c82a
MD5 hash: 6b8921d741b403ba3cc16a108827af68
humanhash: lithium-avocado-lamp-pip
File name:6b8921d741b403ba3cc16a108827af68.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:422'912 bytes
First seen:2020-10-05 14:52:13 UTC
Last seen:2020-10-05 16:14:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:HKf+0/hitjkl6VgLFRgaQjiOPk1Rtl0izPo4j1midFKnD:q2glfgaQjdPkftlhf1E
Threatray 147 similar samples on MalwareBazaar
TLSH 7B948CBD38932B6CC53B073581A544C3B27A22C63F61CE0E616B631C1F9365B93A765E
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68270/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Launching a process
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
69 / 100
Link:
https://www.joesandbox.com/analysis/481700
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Creates an autostart registry key pointing to binary in C:\Windows
Drops PE files to the user root directory
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 293354 Sample: jNth0PEkVS.exe Startdate: 05/10/2020 Architecture: WINDOWS Score: 69 33 Malicious sample detected (through community Yara rule) 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected FormBook 2->37 39 2 other signatures 2->39 7 jNth0PEkVS.exe 9 2->7         started        11 pcalua.exe 1 1 2->11         started        13 pcalua.exe 1 2->13         started        process3 file4 25 C:\Users\user\chrmo.exe, PE32 7->25 dropped 27 C:\Users\user\AppData\...\jNth0PEkVS.exe.log, ASCII 7->27 dropped 29 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 7->29 dropped 31 C:\Users\user\AppData\Local\Temp\...\f.dll, PE32 7->31 dropped 43 Drops PE files to the user root directory 7->43 45 Tries to detect virtualization through RDTSC time measurements 7->45 15 chrmo.exe 2 7->15         started        18 cmd.exe 1 7->18         started        signatures5 process6 signatures7 47 Multi AV Scanner detection for dropped file 15->47 49 Tries to detect virtualization through RDTSC time measurements 15->49 20 reg.exe 1 1 18->20         started        23 conhost.exe 18->23         started        process8 signatures9 41 Creates an autostart registry key pointing to binary in C:\Windows 20->41
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a25765e7d969b6c324cc461b08d947d49204191d97f620b4a74ba0f6dc744ca/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 14:32:35 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2f074d479236e1b4b36733f1e071d6c053a135025cbc62ccc233776b23604390
Formbook
73f6286bd85316cb72796f461e1ad724b8434837f1a10a4a625862c3a7e3c173
Formbook
93129fbf583ce2e637e0a21c490a549e1597902179636ebc13a7c937b5707782
Formbook
b796ebc23a355b8fbd29552b2ff7142f09617c25a30a33d5a92626f69e337d48
Formbook
c1830ba81a707357031fc8e5cd7cf3a6083c30f33669fe29590cc639140d6780
Formbook
c2981a728305c1d0acf84d81922860e2d864409d8602b499258b4e51e9e04c4b
Formbook
c62ef08103c30d5d2d18fbc2eff820985af40aa377828ef72c3ecad495103511
Formbook
ca86c76c753d3c8812228b08c1459bdee50a40b0aa36460906e452f80258c1b7
Formbook
d9600ffc9406d71c60b7eb036248230510c3b971a1de563ca7b8b57e822f7879
Formbook
e85f434810652692f3e0a0738d9156899afcbd2bed42a6f328f0092d72a1db34
Formbook
+ 137 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat persistence trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201005-2rmpjddn9x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.remotelearningexamples.com/bpi/
Unpacked files
SH256 hash:
019fb3bac06f9ccac4365eb3a784c908427f60dccdf36821eae1d05cf10b701b
MD5 hash:
773a2b658936169480a390f44acafb1a
SHA1 hash:
fc965e274d891fa1c01f97ea22073133ad49ecf3
Link:
https://www.unpac.me/results/178a7196-1dad-423c-be97-974915a92b4c/
SH256 hash:
6a25765e7d969b6c324cc461b08d947d49204191d97f620b4a74ba0f6dc744ca
MD5 hash:
6b8921d741b403ba3cc16a108827af68
SHA1 hash:
c6a305733bc47dc26cd3e17de2375112d165c82a
Link:
https://www.unpac.me/results/178a7196-1dad-423c-be97-974915a92b4c/
SH256 hash:
d065744c83c37b059fd345011b6c21297a5de8bc5ebbc93f05add6315bee770a
MD5 hash:
17d8bbf85363bf3ca0f6b4d0154dfeb7
SHA1 hash:
6295dcb6bfd8907d47b3db14d0d4b230c4f07186
Link:
https://www.unpac.me/results/178a7196-1dad-423c-be97-974915a92b4c/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/178a7196-1dad-423c-be97-974915a92b4c/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
SH256 hash:
ae48668c5c5cd23a5640d6e195a7bbdbd7ca2b936ff22da1ba779e6b362b0a92
MD5 hash:
32ca207b0abe5b7cf6718e585d1f409c
SHA1 hash:
3fe95a9a7d93a7bcb9a1e19307c58d1530e9d2fc
Link:
https://www.unpac.me/results/178a7196-1dad-423c-be97-974915a92b4c/
SH256 hash:
0638303852bc306e557bf821d9d2fb181d9eda0a1b7152e1ff72e54fba9d4053
MD5 hash:
686c661f437d5521b3083fff2ca8ca39
SHA1 hash:
44633da142da035df4e792487b03042af38a5bf4
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/178a7196-1dad-423c-be97-974915a92b4c/
Parent samples :
6a25765e7d969b6c324cc461b08d947d49204191d97f620b4a74ba0f6dc744ca
e30d5f240c8600e531832e61f6abddde973ba724b55e8c8bb455a151607b40a3
SH256 hash:
40726061166d212af1664b5c76d4216b7a40ddd28affdd545c980d092cea1d3f
MD5 hash:
a6f1a2f3bea3b5a61cdc0d092632799d
SHA1 hash:
8bc1d82db7fd5bd5ba66b85e53ea4f3556ab3152
Link:
https://www.unpac.me/results/178a7196-1dad-423c-be97-974915a92b4c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a25765e7d969b6c324cc461b08d947d49204191d97f620b4a74ba0f6dc744ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 6a25765e7d969b6c324cc461b08d947d49204191d97f620b4a74ba0f6dc744ca

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/68270/
  
URLhaus
https://urlhaus.abuse.ch/url/655360/
  
Delivery method
Distributed via web download

Comments