MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 751b3fa113056b20cd9b3c6a2f2c06d0b8fa0ecd23696feb27adeb0f53d73b36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 751b3fa113056b20cd9b3c6a2f2c06d0b8fa0ecd23696feb27adeb0f53d73b36
SHA3-384 hash: 6c5ff2fd45ddbe2a68a0b4a6bb80aed4b6a22d1f271016919be8336ab364a3577f6d42ad84dc72935dd94c5f6f06dbc2
SHA1 hash: cb2c92af4547c41aac34532cb8c0127135f9f6fd
MD5 hash: f6a94954c08d82666aff8cd757c83b31
humanhash: pasta-stream-freddie-uniform
File name:ORDER#AP06-4113_APRIL FIRST ORDER_39202202-4014-9300202933.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:654'400 bytes
First seen:2021-04-06 07:46:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'749 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 12288:d0csCJiYFJlsr3IpLobzUCNSXAIqDyOiyCyYP2Dm/KLxEB:TJJiYFJ9pLo0CNSXmyOvu26/ixEB
Threatray 25 similar samples on MalwareBazaar
TLSH DAD4E161E3955CE9E80B067E96FBF8152123BE9994324D1D21AF322D9BB334250F7D0B
Reporter FORMALITYDE
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ORDER#AP06-4113_APRIL FIRST ORDER_39202202-4014-9300202933.exe
Verdict:
Malicious activity
Analysis date:
2021-04-06 07:47:50 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/a37835a7-12f9-4c8c-9d6b-09ac56ef83b1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132595/
Detection(s):
SecuriteInfo.com.FileRepMalware.24015.25487.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Sending a UDP request
Launching a process
Launching cmd.exe command interpreter
Sending an HTTP GET request
Setting browser functions hooks
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/667263
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 382562 Sample: ORDER#AP06-4113_APRIL FIRST... Startdate: 06/04/2021 Architecture: WINDOWS Score: 100 37 www.magnoliarealtygrandbury.com 2->37 39 magnoliarealtygrandbury.com 2->39 41 www.nbytjszp.com 2->41 49 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 9 other signatures 2->55 11 ORDER#AP06-4113_APRIL FIRST ORDER_39202202-4014-9300202933.exe 5 2->11         started        signatures3 process4 file5 29 ORDER#AP06-4113_AP...4014-9300202933.exe, PE32 11->29 dropped 31 C:\Users\user\AppData\...\AudioCaptures.exe, PE32 11->31 dropped 33 ORDER#AP06-4113_AP...exe:Zone.Identifier, ASCII 11->33 dropped 35 ORDER#AP06-4113_AP...-9300202933.exe.log, ASCII 11->35 dropped 65 Creates an undocumented autostart registry key 11->65 67 Writes to foreign memory regions 11->67 69 Injects a PE file into a foreign processes 11->69 15 ORDER#AP06-4113_APRIL FIRST ORDER_39202202-4014-9300202933.exe 11->15         started        signatures6 process7 signatures8 71 Modifies the context of a thread in another process (thread injection) 15->71 73 Maps a DLL or memory area into another process 15->73 75 Sample uses process hollowing technique 15->75 77 Queues an APC in another process (thread injection) 15->77 18 explorer.exe 15->18 injected process9 dnsIp10 43 valerielimozin.com 109.234.162.40, 49713, 80 O2SWITCHFR France 18->43 45 elizabethharcourt.com 203.98.95.4, 49735, 80 DIGITALPACIFIC-AUDigitalPacificPtyLtdAustraliaAU Australia 18->45 47 3 other IPs or domains 18->47 57 System process connects to network (likely due to code injection or exploit) 18->57 22 msdt.exe 18->22         started        signatures11 process12 signatures13 59 Modifies the context of a thread in another process (thread injection) 22->59 61 Maps a DLL or memory area into another process 22->61 63 Tries to detect virtualization through RDTSC time measurements 22->63 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/751b3fa113056b20cd9b3c6a2f2c06d0b8fa0ecd23696feb27adeb0f53d73b36/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ount7iitavvsbtm3hrvc6lag2c4pudwnenuw72zhvxvq6u6xhm3a._file
Verdict:
suspicious
Similar samples:
1cef46cbb22cfda50b0e93dadedfb09f511b80e802d239270c96954a38d11f28
Formbook
25dd98cbd230e272bb55aaf5acd0f6cb0e8ec897ec5c0684b5308a0022af175f
Formbook
4958b38f87f76e4d9345736b410d30ede5aea42bac171e1e2cbd94d1f9856db8
Formbook
4de20c38ffff3f9d75d9a446f152c017d9010477c28c8b97875f95f448ecb761
Formbook
9ec172a2d52237c814d55da6232b9914d21b85a9d79b693d320ac90a0abfdb7d
Formbook
c1c3399ed911782ec14180a857a48231f7e3182dd9340ed6308b9a70cacc2885
Formbook
c52477b06f41b4e78b419e5843c6e14545e7add486185373a66c8de3865f44c0
Formbook
d7789d465be563d19b1ade313c83023363379649f935e333e16643eec1bc150e
Formbook
f4af46ad96a86cad60d613a3387a0a68c580247ef88943e2ea0e5b9679a38c2e
Formbook
f508afb3a24ea2a3865ef48de1c0f2886ac26641ea6c517c727041e11a15e886
Formbook
+ 15 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210406-4qn3k9jjdn/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.organichighqualityrush.com/kfn/
Unpacked files
SH256 hash:
d95e1dc13d4795b7a858517a70e9928851dc2de6b9d390b50e4d476362431630
MD5 hash:
12f884afa78ef3db664b5f889f074ebc
SHA1 hash:
7436eae43ab682ea3692d3d7a7307e556117f78c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/ad4065c6-7cc0-4d08-aa45-77912489c956/
SH256 hash:
781cf4f34c99bfc90daa5c30b3cdfee5238405f79eeff07abef2202f624c0faa
MD5 hash:
e64f63a6f6768317d08c1a22e32cbe05
SHA1 hash:
f29f7683466338674c5a695313280da50228839b
Link:
https://www.unpac.me/results/ad4065c6-7cc0-4d08-aa45-77912489c956/
SH256 hash:
72ebfe27f2e7a4131f98a1eb38b9a7331de1f424a5e3073464dbb7bc8c6334e4
MD5 hash:
a123101bd517ecc6b1555e8fa60b1de9
SHA1 hash:
1504de13775de42681e03297d45a3cc52974f55f
Link:
https://www.unpac.me/results/ad4065c6-7cc0-4d08-aa45-77912489c956/
SH256 hash:
751b3fa113056b20cd9b3c6a2f2c06d0b8fa0ecd23696feb27adeb0f53d73b36
MD5 hash:
f6a94954c08d82666aff8cd757c83b31
SHA1 hash:
cb2c92af4547c41aac34532cb8c0127135f9f6fd
Link:
https://www.unpac.me/results/ad4065c6-7cc0-4d08-aa45-77912489c956/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/751b3fa113056b20cd9b3c6a2f2c06d0b8fa0ecd23696feb27adeb0f53d73b36

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 751b3fa113056b20cd9b3c6a2f2c06d0b8fa0ecd23696feb27adeb0f53d73b36

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/132595/

Comments