MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77b804f939b12235effeb7fa92d705f3604df969fda44f342a96a87b8f9ff4ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77b804f939b12235effeb7fa92d705f3604df969fda44f342a96a87b8f9ff4ab
SHA3-384 hash: c5cc1bdcde15cdc1917720eb3700a37fe9eee580a577019165876ab1cca736cd9eebcb5db88eac98eb4f876b5101843b
SHA1 hash: bb93c07737a7fb26ec03923d6e0f8d46a54f0563
MD5 hash: 50c79c166f660f1daa4edf6b2a655c84
humanhash: pasta-violet-november-cardinal
File name:210127.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:926'208 bytes
First seen:2021-01-28 01:04:41 UTC
Last seen:2021-01-28 02:52:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep 12288:0woBjBnK1WxraLQ2NpkS7s76rwVTD2LXcf7FhzdNTAIF5/VwbN4+vtE+LtZ/NRMG:DoBjBnK1vQ2kSytMCZNTpwqYTfV
Threatray 3'646 similar samples on MalwareBazaar
TLSH B115CF313318AF5AF13F97F48160144093F6B82BE325DA8EBDE664EF6550F80D262A57
Reporter graylee93306180
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://attach.mail.daum.net/bigfile/v1/urls/d/fGeMuRXSAK5-05Ccb3Dg4WjLUoI/oyaGmuvtTCRGeGkq8xSc_Q
Verdict:
No threats detected
Analysis date:
2021-01-27 05:32:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2e5bdb46-b28b-47fc-b66b-283cccbc81fe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/114195/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.6795.17025.10421.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/592549
Signature
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: CMSTP Execution Process Creation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 345317 Sample: 210127.exe Startdate: 28/01/2021 Architecture: WINDOWS Score: 100 33 www.galanggroup.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 7 other signatures 2->47 11 210127.exe 3 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\210127.exe.log, ASCII 11->31 dropped 57 Tries to detect virtualization through RDTSC time measurements 11->57 15 210127.exe 11->15         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 15->59 61 Maps a DLL or memory area into another process 15->61 63 Sample uses process hollowing technique 15->63 65 Queues an APC in another process (thread injection) 15->65 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.binliwine.com 117.18.12.137, 49745, 80 SUNHK-DATA-AS-APSunNetworkHongKongLimited-HongKong Hong Kong 18->35 37 facetreatspa.com 34.102.136.180, 49735, 80 GOOGLEUS United States 18->37 39 10 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 cmstp.exe 18->22         started        25 autoconv.exe 18->25         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 27 cmd.exe 1 22->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/77b804f939b12235effeb7fa92d705f3604df969fda44f342a96a87b8f9ff4ab/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-27 14:50:33 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o64aj6jzwerdl376w75jfvyf6nqe36lj7wse6nbks2uhxd476svq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1288ae44d28cad478afd6fae196164f297b8656977fd2ac34d08ab5877a5b795
Formbook
192d72b9c3606442b19976f325d40ad48b4d397a7c4ac6fb575fbbebf7e06382
Formbook
46c3ab59682596a8e030fb0bad3d31c59e502f68b9f3c112309edd82d27513c3
Formbook
470d8938f9eedf84f9f75a9862f09d98bd0c9d265ede33a2f0983a5c26d17a7f
Formbook
4cd5fc82f7d1094ebe188a372dd682d24083ea423f0b49a057cfacc0af849ac4
Formbook
99c4f75948b26af511bfa055db8d18567a3d662107e35e91102b5576f02acb84
Formbook
c3d490568e73f61c86d2d4c01e170bdcf3c0d3eb5e309ff3d3fb808a4a867a54
Formbook
cf6959fe2bb4c2e078a8bb51c097dfd79bc0ca5cd296090a897ecb30a3ee6102
Formbook
f78a6375389df1b721be110480efd240f604f51868031e72d88cb7612616fb67
Formbook
fc534d33f183a321a447fef1fdef4c8a7fa78413cd15f93df13a39f0a8b9b2fe
Formbook
+ 3'636 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210128-5q2sb7hpve/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.bistrolartichaut.com/gbr/
Unpacked files
SH256 hash:
5bca980ccf29eb49991fe32081f5288d16439fb728873f12287cebf7e1b8055b
MD5 hash:
b89c511a527938cfd3b9f9e43500d10e
SHA1 hash:
636fcef891230b2695d73a4ebd84bbc045bddb16
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/0e79060a-6a1a-42e3-a0a5-1ab772f09347/
Parent samples :
fc534d33f183a321a447fef1fdef4c8a7fa78413cd15f93df13a39f0a8b9b2fe
77b804f939b12235effeb7fa92d705f3604df969fda44f342a96a87b8f9ff4ab
8b19a16ac91b9d47a91f5c5036db519afaf66dfc48d617355a5364eeaf6074a6
dcba694f14ff8249e4d87b0002fd1a69ce2aa13d6d08d9ecffadb4cef9f6e329
SH256 hash:
1725c0c35b20afd79f3978804a2512907df7ad583018d9c4e4a3c4e1267ef5f0
MD5 hash:
775032992085818948938e7d5349b0b9
SHA1 hash:
bbd83e192e4862df830580386cf716bbea1a6bfc
Link:
https://www.unpac.me/results/0e79060a-6a1a-42e3-a0a5-1ab772f09347/
SH256 hash:
537e65dd9e76775e4d11fa6d497565fc07d6e361bfabae0a984df851f746c2da
MD5 hash:
87beb303f3697ea64636ffcc61dd9f6b
SHA1 hash:
5e4ff3b5bf843df69ef6442d3013ff516406cb1e
Link:
https://www.unpac.me/results/0e79060a-6a1a-42e3-a0a5-1ab772f09347/
SH256 hash:
77b804f939b12235effeb7fa92d705f3604df969fda44f342a96a87b8f9ff4ab
MD5 hash:
50c79c166f660f1daa4edf6b2a655c84
SHA1 hash:
bb93c07737a7fb26ec03923d6e0f8d46a54f0563
Link:
https://www.unpac.me/results/0e79060a-6a1a-42e3-a0a5-1ab772f09347/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77b804f939b12235effeb7fa92d705f3604df969fda44f342a96a87b8f9ff4ab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/114195/

Comments