MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e0b67c69b922762b4dd074cb6669f1080e78577b115bb9dd673df1b44937c6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e0b67c69b922762b4dd074cb6669f1080e78577b115bb9dd673df1b44937c6b
SHA3-384 hash: 990ab4f19bbf7b20c89351d1073fd6612637cf64da4c2e43ceb4bcefdc5960e37631e9f553e603ce73a538826619278e
SHA1 hash: 355344a215d8f61327f31fdec85ba93038f54374
MD5 hash: cdb79c6eee195332d11b14ba3cee3ada
humanhash: mexico-louisiana-blossom-october
File name:SOA.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:683'008 bytes
First seen:2021-02-22 07:07:17 UTC
Last seen:2021-02-22 08:41:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:CZiEhgH6FzSn1qYarYnQze/g63Pr+HJibEC4Xq1crBE6n:CZiH6FzSnpa0nj/ZPr+pBdr9
Threatray 3'911 similar samples on MalwareBazaar
TLSH 75E4E05332D48658DE7927F76226008077E5ADBBAA18E25C6FC832D71BF27D04432B67
Reporter fabjer
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/118207/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42850.25297.5764.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/613694
Signature
Binary contains a suspicious time stamp
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 355853 Sample: SOA.exe Startdate: 22/02/2021 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 5 other signatures 2->46 10 SOA.exe 3 2->10         started        process3 file4 32 C:\Users\user\AppData\Local\...\SOA.exe.log, ASCII 10->32 dropped 56 Tries to detect virtualization through RDTSC time measurements 10->56 58 Injects a PE file into a foreign processes 10->58 14 SOA.exe 10->14         started        17 SOA.exe 10->17         started        19 SOA.exe 10->19         started        signatures5 process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 14->60 62 Maps a DLL or memory area into another process 14->62 64 Sample uses process hollowing technique 14->64 66 Queues an APC in another process (thread injection) 14->66 21 explorer.exe 14->21 injected process8 dnsIp9 34 retrospectphotographydesign.com 184.168.131.241, 49773, 80 AS-26496-GO-DADDY-COM-LLCUS United States 21->34 36 www.retrospectphotographydesign.com 21->36 38 www.fun4gang.xyz 21->38 48 System process connects to network (likely due to code injection or exploit) 21->48 25 cmd.exe 21->25         started        signatures10 process11 signatures12 50 Modifies the context of a thread in another process (thread injection) 25->50 52 Maps a DLL or memory area into another process 25->52 54 Tries to detect virtualization through RDTSC time measurements 25->54 28 cmd.exe 1 25->28         started        process13 process14 30 conhost.exe 28->30         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6e0b67c69b922762b4dd074cb6669f1080e78577b115bb9dd673df1b44937c6b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-22 03:58:40 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nyfwpru3sitwfng5a5glmzu7ccaopblxwek3xhowopprwretprvq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
418c91165a110d4877cb2932db456e37715dd6ea494712bb6cebd009eb090727
Formbook
4c51f78fbe90c4455d1a0c1f45ff575571974df030b1ea188bf9ab67f4552c68
Formbook
563bb7942710f08ce409f8418fd0d917877998c978ab0155cb3c1b5eec3b1e7b
Formbook
5d617282230f991221360f213e15b0e62d0c462afc3d32299c9b410658fbb106
Formbook
720ffc99aa96c665aae27db46f776476c37ca113db207790579adfd81c73ad05
Formbook
728f4462fb60eaaf040fae6f8993c8f64139715f97d3c16db43932b447709426
Formbook
957c5b5a6f0af47354f9ed2d09522fc671b8c0af06e3f3a5b6354e111b2c8129
Formbook
b69927fbfd7eb038b59aa9b7e9f49cb02d127d48fcf6517e65a379e982e806bc
Formbook
bc2cc312ba11b1945f2fc371ddc960e24ae3fa9cf9117e51d8efa152b8bee2c8
Formbook
f09416ef7aaab2c43c62ef77bb69c005ec4a57d4051586f5e7d8571e74fee41c
Formbook
+ 3'901 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210222-r34sntd4kj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.fun4gang.xyz/thg/
Unpacked files
SH256 hash:
3be807046cf3ef1216b191923f732d8733c626c7c56157a4fe6d7b1bab0d3e24
MD5 hash:
4f9ae5a7c06975983ed4c5a9c1db2210
SHA1 hash:
f7f7700d2e65ac995e68b91fac5cbe4f4d65d329
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/54afdd2b-baf2-43c0-b2d4-c99205155357/
Parent samples :
bc2cc312ba11b1945f2fc371ddc960e24ae3fa9cf9117e51d8efa152b8bee2c8
357c55fac31eb641cb3cec37663a829e2745f3cd4af08b6fc0c1634ef3eee1b6
6e0b67c69b922762b4dd074cb6669f1080e78577b115bb9dd673df1b44937c6b
8eb77ec70c44e86607e97ce926cdb4e0610a0199c348fa329dba50bef34d5fc1
SH256 hash:
fd530f7f9a739cb128d3c230a26e2754a774a9f4bc91cb3006b4c649c33024a2
MD5 hash:
cae289bd54d2059e1bcae5beab68bbc3
SHA1 hash:
cf152e3f581ad04296fadb5d452f647b01c2c4a4
Link:
https://www.unpac.me/results/54afdd2b-baf2-43c0-b2d4-c99205155357/
SH256 hash:
f0a09c48af16c079c37ad0914f18897976357981fe5ee6f556ab9f9f70b9a671
MD5 hash:
f984a71581f6da5732110be2a569a392
SHA1 hash:
10de05b6b35fc5dbc00c42d59a4b850bcaae01e6
Link:
https://www.unpac.me/results/54afdd2b-baf2-43c0-b2d4-c99205155357/
SH256 hash:
6e0b67c69b922762b4dd074cb6669f1080e78577b115bb9dd673df1b44937c6b
MD5 hash:
cdb79c6eee195332d11b14ba3cee3ada
SHA1 hash:
355344a215d8f61327f31fdec85ba93038f54374
Link:
https://www.unpac.me/results/54afdd2b-baf2-43c0-b2d4-c99205155357/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip e648242a45bb301624f021da66376b86fdb9ea6eab702574c5a1504a75655d15

Formbook

Executable exe 6e0b67c69b922762b4dd074cb6669f1080e78577b115bb9dd673df1b44937c6b

(this sample)

  
Dropped by
SHA256 e648242a45bb301624f021da66376b86fdb9ea6eab702574c5a1504a75655d15
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/118207/

Comments