MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 771227e76d8a6029a3e557f2ce522002b07941e17289d1cdd5edafb29d42b1a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 771227e76d8a6029a3e557f2ce522002b07941e17289d1cdd5edafb29d42b1a9
SHA3-384 hash: 9630066c2587a1b01c944f4c1a209b5a2b1b6bda4625bf7ccf0841a07a23719b264f6ea61154743916e741fe917937a6
SHA1 hash: da34d309c23aaa40cad0dfe553b1cd8a967f6831
MD5 hash: 7236b609fe63f7e878c033acc2e3786d
humanhash: asparagus-high-missouri-twelve
File name:uzo.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:457'216 bytes
First seen:2020-09-14 15:14:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:fHMUB2iNgUsNKAZb8TrhWxwOFsw7fn9OqiI9v2zv1g:EO1aUeKahOl2/B02
Threatray 2'236 similar samples on MalwareBazaar
TLSH F1A41212B3C5AF68F5BE4B392091572117F295FAAB02FB2CBCA521FD39B2B501741253
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/59325/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/465557
Signature
Allocates memory in foreign processes
Benign windows process drops PE files
Detected FormBook malware
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses netstat to query active network connections and open ports
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 285187 Sample: uzo.exe Startdate: 14/09/2020 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 6 other signatures 2->54 10 uzo.exe 3 2->10         started        process3 file4 42 C:\Users\user\AppData\Local\...\uzo.exe.log, ASCII 10->42 dropped 68 Writes to foreign memory regions 10->68 70 Allocates memory in foreign processes 10->70 72 Injects a PE file into a foreign processes 10->72 14 RegSvcs.exe 10->14         started        signatures5 process6 signatures7 74 Modifies the context of a thread in another process (thread injection) 14->74 76 Maps a DLL or memory area into another process 14->76 78 Sample uses process hollowing technique 14->78 80 2 other signatures 14->80 17 explorer.exe 4 6 14->17 injected process8 dnsIp9 44 ourbrightstar.com 34.102.136.180, 49746, 80 GOOGLEUS United States 17->44 46 www.ourbrightstar.com 17->46 36 C:\Users\user\AppData\Local\...\dfix-8pbx.exe, PE32 17->36 dropped 56 System process connects to network (likely due to code injection or exploit) 17->56 58 Benign windows process drops PE files 17->58 22 NETSTAT.EXE 1 17 17->22         started        26 dfix-8pbx.exe 2 17->26         started        28 dfix-8pbx.exe 17->28         started        file10 signatures11 process12 file13 38 C:\Users\user\AppData\...\KN6logrv.ini, data 22->38 dropped 40 C:\Users\user\AppData\...\KN6logri.ini, data 22->40 dropped 60 Detected FormBook malware 22->60 62 Tries to steal Mail credentials (via file access) 22->62 64 Tries to harvest and steal browser information (history, passwords, etc) 22->64 66 3 other signatures 22->66 30 cmd.exe 1 22->30         started        32 conhost.exe 26->32         started        signatures14 process15 process16 34 conhost.exe 30->34         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/771227e76d8a6029a3e557f2ce522002b07941e17289d1cdd5edafb29d42b1a9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-14 13:43:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4jcpz3nrjqcti7fk7zm4uraakyhsqpboke5dtov5wx3fhkcwguq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0de7b2b7c4e9974b9343de9666287a7137614cbcffc5f89932601b503712002a
FormBook
14bd8d29b58463ac3b3422f269aad880b129cd6354d3a033614d254f8dde4569
FormBook
1d433633d08421004a24c04b8a6a05b9c19afde22e6869c82f9cbe6aaad568fd
FormBook
4458df211fccf5c1d24b96ebb7b4191cc94edc0b0e13bbb80ae3919f015297d9
FormBook
a05ae5c56a5a5c24f2c7276f2c669cb33c09f87d75a09030b094f12a4a1a17fa
FormBook
ad660d774f78137622d038976557c8782211dbfd39d2ff9a7a4bcc9279ba0f41
FormBook
b2a437bec36856a90558f9f54873096e6d1324cf487cc265038dbe82e5b03788
FormBook
b3423777b1bafbe661edd1f4d3d98e72fcb48394764ddeb57bb913b881cf9177
FormBook
b9225c079305112fcd1d5be698796eb426a668779daff06b99986266c161ab52
FormBook
ef19177bdff9d49a09dd7010e58fd81029d5f8e2d54abb053575604c2fc219ed
FormBook
+ 2'226 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200914-q3hqghb71j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.glowtey.com/bnc/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/59325/
  
URLhaus
https://urlhaus.abuse.ch/url/498423/

Comments