MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6da5af0a0601c6ad4b492ed60b8e08d2fbb2858b862a7b67a26845d8cea92734. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6da5af0a0601c6ad4b492ed60b8e08d2fbb2858b862a7b67a26845d8cea92734
SHA3-384 hash: 113a80ac611c37ab79e1f38f479dfc10527cce12d1a2e0a06ea2be387091217df72bb38cbb3ebfcd2e07e275db0daf66
SHA1 hash: 51b276685c3802fb7f0cc1f8670c2d7360c16a6a
MD5 hash: f860269d3a118de01fb513869a3f809c
humanhash: alabama-orange-winter-cat
File name:JUSTIFICANTE.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:800'768 bytes
First seen:2021-07-18 15:43:19 UTC
Last seen:2021-07-18 16:47:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:I9c4GuO6LfLN+2/n9i8nV6Ph/oCA6eZR0BUng:IW4Guho2/nY8V0oj6rX
Threatray 6'560 similar samples on MalwareBazaar
TLSH T1B50502157B80FB4EC6394E7884229C10ABE0E6775307E78B7EF315EC558E6D98A311E2
Reporter Racco42
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172423/
Detection(s):
SecuriteInfo.com.PWS-FCXVF860269D3A11.8948.25377.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d38734c7-1a1f-44e9-96cc-895d7262e882
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817938
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Defender Exclusion
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 450349 Sample: JUSTIFICANTE.exe Startdate: 18/07/2021 Architecture: WINDOWS Score: 100 35 clientconfig.passport.net 2->35 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 7 other signatures 2->49 11 JUSTIFICANTE.exe 4 2->11         started        signatures3 process4 file5 33 C:\Users\user\...\JUSTIFICANTE.exe.log, ASCII 11->33 dropped 59 Adds a directory exclusion to Windows Defender 11->59 61 Tries to detect virtualization through RDTSC time measurements 11->61 63 Injects a PE file into a foreign processes 11->63 15 JUSTIFICANTE.exe 11->15         started        18 powershell.exe 26 11->18         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 15->65 67 Maps a DLL or memory area into another process 15->67 69 Sample uses process hollowing technique 15->69 71 Queues an APC in another process (thread injection) 15->71 20 explorer.exe 15->20 injected 24 conhost.exe 18->24         started        process9 dnsIp10 37 joycemkennedy.com 50.116.71.161, 49747, 80 UNIFIEDLAYER-AS-1US United States 20->37 39 zonalibrenoticias.com 209.236.114.106, 49745, 80 ASN-DISUS United States 20->39 41 2 other IPs or domains 20->41 51 System process connects to network (likely due to code injection or exploit) 20->51 26 colorcpl.exe 20->26         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 26->53 55 Maps a DLL or memory area into another process 26->55 57 Tries to detect virtualization through RDTSC time measurements 26->57 29 cmd.exe 1 26->29         started        process14 process15 31 conhost.exe 29->31         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6da5af0a0601c6ad4b492ed60b8e08d2fbb2858b862a7b67a26845d8cea92734/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-07-14 10:44:46 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nws26cqgahdk2s2jf3laxdqi2l53fbmlqyvhwz5cnbc5rtvje42a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
25644ff35da89545c702b633182c4ff1f649dd64c9c8249be9afe7090359d87d
Formbook
3ee6f995f613e6a7e1e55c7a40d710701abead643e0ec9712c7dedb1800be01a
Formbook
74038c5bbdbded24e577d6c081d88febe59735546d902323a310e2e9d3f66677
Formbook
78b11874a66b80ec78962b27c352a643d1a11c7f5cf9273f0db06df3f4f7e76c
Formbook
a2e99d0aabd8f0ad83b885eccf313563526a58b2da435bf34dad29294c712efe
Formbook
b3c5b3cf581d15fcbacf67b4bdba199bfe7089704875746109b3206eb07b99e2
Formbook
c347c2d7579053d263f6ab6eddca7bd03691ebab93b30b5caba462caa7106beb
Formbook
d0116b0ea676a655b1d55a2b7a79fb2585c1d04803e9d1d6f9cd1da15f789138
Formbook
d869fa27fd5d5a229609f218572f1625820cb8176ba6c1616714e40d4e6b7897
Formbook
e8be28fabd7cdb2d4e96137dae73bd9b227a86b654c696e9fd401cb37ec68267
Formbook
+ 6'550 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210718-bb5l5ylm3e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.naughty-milf-gfe.today/m3uc/
Unpacked files
SH256 hash:
8a0935669b03998430a7060ae556436f518e81cffc394b93790af62862ed0d07
MD5 hash:
4704316039bd3875d7ba59e1085a5108
SHA1 hash:
668f4ef9631ac079e41ae9fb6eed6ee351f37eea
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/aa828b3c-072e-435b-9711-bd00f6d57cce/
Parent samples :
6da5af0a0601c6ad4b492ed60b8e08d2fbb2858b862a7b67a26845d8cea92734
47497b994ad65d13a2a3e030620907bc57295ef45a86a5248890256166e11dc9
9404674e08d2d675f2d304d6c80ab25b857281973d00d06dd3ca367b03f8eacd
df8b0772860e56938078f92e437d4c04ff34808f40837e249b85af1ffb4dee4b
SH256 hash:
56ab692daee1343602c8253db10c80841fb60a9ab29f65f105dbfbf77dde083c
MD5 hash:
7c71597322bf4b4f74cfe1e6d47d6015
SHA1 hash:
fd1d795dd055eb57516e474eb96fe5eb10bbbd03
Link:
https://www.unpac.me/results/aa828b3c-072e-435b-9711-bd00f6d57cce/
SH256 hash:
5f5257e30cfc2caab058013ffc60f90fb8a5d780a14834e1371054290b7658e4
MD5 hash:
b0e14c3526d6623ae9b7b5f5e0efde76
SHA1 hash:
f7d127bff2dfb1100ebd55fdd12dfb7a2b382fdc
Link:
https://www.unpac.me/results/aa828b3c-072e-435b-9711-bd00f6d57cce/
SH256 hash:
4fffc45edeeb2b96f099d21bcff43c59e813c40592da233ec21f27fd63bff0ce
MD5 hash:
cf5e831f8254feccece70235d1f47fc4
SHA1 hash:
0bd2ca0c05afd677c58a4b6e6c2af876700e24e1
Link:
https://www.unpac.me/results/aa828b3c-072e-435b-9711-bd00f6d57cce/
SH256 hash:
49a0fdc8d956e3f8fe5274152472cbc7d3e9e1359be3d544e50b88b8e1a0fa8d
MD5 hash:
36031e2be6fe61420d859db5bb4dfef2
SHA1 hash:
75e4852ed09854c4f13347c7e3e3717af837857f
Link:
https://www.unpac.me/results/aa828b3c-072e-435b-9711-bd00f6d57cce/
SH256 hash:
6da5af0a0601c6ad4b492ed60b8e08d2fbb2858b862a7b67a26845d8cea92734
MD5 hash:
f860269d3a118de01fb513869a3f809c
SHA1 hash:
51b276685c3802fb7f0cc1f8670c2d7360c16a6a
Link:
https://www.unpac.me/results/aa828b3c-072e-435b-9711-bd00f6d57cce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6da5af0a0601c6ad4b492ed60b8e08d2fbb2858b862a7b67a26845d8cea92734

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 6da5af0a0601c6ad4b492ed60b8e08d2fbb2858b862a7b67a26845d8cea92734

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/172423/

Comments