MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76f102f79f2f05a30e4cf14c377ce7e7987fd4937cd7b11190c9c21925d82921. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76f102f79f2f05a30e4cf14c377ce7e7987fd4937cd7b11190c9c21925d82921
SHA3-384 hash: 3ad0085e0530f5659ffdee106c212bb521ca303ede02ed4770ee158a57d8277bfcee589fdc34861d2c2ff42bbc88972b
SHA1 hash: 9477cdde1123a3b5ecf2f639aa2dc7958e54a2cb
MD5 hash: 7c0abe3ed74b20a8dd38745ee0a83dd3
humanhash: indigo-purple-papa-lemon
File name:RFQPO90865802ICONME.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:349'696 bytes
First seen:2021-01-06 16:10:50 UTC
Last seen:2021-01-06 18:08:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 31c815897a3b55d8d8afcee958fa181c (3 x Formbook, 2 x AgentTesla, 1 x NanoCore)
ssdeep 6144:vNrLL3ZbqFpa0o5XdqZkWgbhYUNU24tgSe8Yy2xtSMXmJkioqF+Dsz5UdcoWHOUF:vVZsUDYE0eLSMIoEz5UdDiQe
Threatray 3'346 similar samples on MalwareBazaar
TLSH 58744A26B3C8F6A6D18144B47109FFAA40613C34696EC843B7C17B5B38725EE9A06F5F
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: samir Amjad <samir@iconme.net>
Reply-To: samir@iconme.net
Subject: RFQ/PO90865802/ICONME
Attachment: RFQPO90865802ICONME.rar (contains "RFQPO90865802ICONME.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQPO90865802ICONME.exe
Verdict:
Malicious activity
Analysis date:
2021-01-06 16:17:51 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/5236f0b3-8da7-401c-89ab-77b750f17bae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/110753/
Detection(s):
SecuriteInfo.com.Artemis7C0ABE3ED74B.31806.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Sending a UDP request
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/575236
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 336674 Sample: RFQPO90865802ICONME.exe Startdate: 06/01/2021 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->35 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 6 other signatures 2->41 10 RFQPO90865802ICONME.exe 2->10         started        process3 signatures4 49 Maps a DLL or memory area into another process 10->49 51 Tries to detect virtualization through RDTSC time measurements 10->51 13 RFQPO90865802ICONME.exe 10->13         started        process5 signatures6 53 Modifies the context of a thread in another process (thread injection) 13->53 55 Maps a DLL or memory area into another process 13->55 57 Sample uses process hollowing technique 13->57 59 Queues an APC in another process (thread injection) 13->59 16 explorer.exe 13->16 injected process7 dnsIp8 27 amarresdeamoryendulzamiento.com 192.185.131.105, 49753, 80 UNIFIEDLAYER-AS-1US United States 16->27 29 liwaaalahmad.com 51.75.154.83, 49740, 80 OVHFR France 16->29 31 6 other IPs or domains 16->31 33 System process connects to network (likely due to code injection or exploit) 16->33 20 ipconfig.exe 16->20         started        signatures9 process10 signatures11 43 Modifies the context of a thread in another process (thread injection) 20->43 45 Maps a DLL or memory area into another process 20->45 47 Tries to detect virtualization through RDTSC time measurements 20->47 23 cmd.exe 1 20->23         started        process12 process13 25 conhost.exe 23->25         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/76f102f79f2f05a30e4cf14c377ce7e7987fd4937cd7b11190c9c21925d82921/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 10:49:21 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o3yqf547f4c2gdsm6fgdo7hh46mh7vetptl3cemqzhbbsjoyfeqq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
04a2b06549eb2ce73a5405a14ba3dd9e13029665382b31984aa41f36841b28d5
Formbook
2829f8bf819c13d753f3c6b33726df8c46a533f3040b550a86ca0ab34f967e92
Formbook
45cf51569314dac91762e5c1f112c4a640595239d553729f10613f9f59403e84
Formbook
496312b0f2439d09765eb76ce146369b9417f59225f86c9b5f0ef8e1bb880602
Formbook
53878a7b306a51e03f35297ea81e42c7aa079665928f8ca0d1f1732c0da82ffe
Formbook
7aa337be7c2fc3d45a829aabcc060f86eac6ae53d878194cc253cfb8e228abf2
Formbook
911fec402f3bb42d731c4e177c322c0df8d79f680e5a18f538a3ff2e3086c2bf
Formbook
a6c4cf62dc3f99465080ac5cd48a2f2f1423bb90d3d797ed27905225438d4f35
Formbook
adfbe10537f150b8d3e8efa0e2131a4d45d4f80671880a9f729e678c2d7244b5
Formbook
bd53fc041a6e364f163c70e2bcf38a1565f3764a31b8c94de466fce780f9ab71
Formbook
+ 3'336 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210106-ppwbvp5bxa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.minimalgent.com/heye/
Unpacked files
SH256 hash:
3fff5f3adf822fb5aa359a0585afaa385ab8671ea4ae37b6f35030542d6bbc03
MD5 hash:
136f83c671c4c3ab33766460012c4fcf
SHA1 hash:
9b8440ebd3dbfc681c2f95918c1f91cb6522b661
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/adf69398-d663-4ccf-a3f7-7d66e3c402c8/
Parent samples :
adfbe10537f150b8d3e8efa0e2131a4d45d4f80671880a9f729e678c2d7244b5
04a2b06549eb2ce73a5405a14ba3dd9e13029665382b31984aa41f36841b28d5
7aa337be7c2fc3d45a829aabcc060f86eac6ae53d878194cc253cfb8e228abf2
a6c4cf62dc3f99465080ac5cd48a2f2f1423bb90d3d797ed27905225438d4f35
53878a7b306a51e03f35297ea81e42c7aa079665928f8ca0d1f1732c0da82ffe
76f102f79f2f05a30e4cf14c377ce7e7987fd4937cd7b11190c9c21925d82921
SH256 hash:
76f102f79f2f05a30e4cf14c377ce7e7987fd4937cd7b11190c9c21925d82921
MD5 hash:
7c0abe3ed74b20a8dd38745ee0a83dd3
SHA1 hash:
9477cdde1123a3b5ecf2f639aa2dc7958e54a2cb
Link:
https://www.unpac.me/results/adf69398-d663-4ccf-a3f7-7d66e3c402c8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76f102f79f2f05a30e4cf14c377ce7e7987fd4937cd7b11190c9c21925d82921

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 0f6ed43f17e978425e08017b46af576ffae3876794b7831466bbdab73ee111e1

Formbook

Executable exe 76f102f79f2f05a30e4cf14c377ce7e7987fd4937cd7b11190c9c21925d82921

(this sample)

  
Dropped by
MD5 ed801a0f03e79bf43ebec2fe325ccacc
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 0f6ed43f17e978425e08017b46af576ffae3876794b7831466bbdab73ee111e1
Cape
Cape
https://www.capesandbox.com/analysis/110753/

Comments