MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7843242690547cf0b4ebea118783c903b99c3a211f1775db3cf24b09fbe2454a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7843242690547cf0b4ebea118783c903b99c3a211f1775db3cf24b09fbe2454a
SHA3-384 hash: e0e08ec5c9f08441602065f96c145773f17d2b74c5c1c872db1c9f6b7cb956e0e138369a76854bd80ee9c2b2a41b0c9f
SHA1 hash: 358f37517e4624678182e8f70a135dcee9f1052a
MD5 hash: 2e15b0340269d155525dbdf2c3d4ea16
humanhash: kilo-jig-neptune-nevada
File name:Letter of Demand and Unpaid invoice.pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:674'304 bytes
First seen:2020-10-22 07:37:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:uHueWwycd6dcIi1cqJdiVQJYXbttM4449ICLLcYzLd9A1GKZHNYPzodwrJ:Eus6d21xAOYR4OZRzLfA1GUKzodwr
Threatray 2'618 similar samples on MalwareBazaar
TLSH D9E4D01730D61F99EEEE8BFE290C58E19373AC9E8372E1643D9161EA15C27006758F1B
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

From: collections@debtbusters.co.za
Subject: Letter of Demand // Overdue Account
Attachment: Letter of Demand and Unpaid invoice.pdf.gz (contains "Letter of Demand and Unpaid invoice.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74543/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7843242690547cf0b4ebea118783c903b99c3a211f1775db3cf24b09fbe2454a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 04:19:38 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pbbsijuqkr6pbnhl5iiypa6jao4zyorbd4lxlwz46jfqt67civfa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
07528f3c583c546d2b444b091c3ede380c6427ed0691b95294c7e32dd35560ab
Formbook
0c3afc73b1560d5d817104a616325e9f7a825e6b0158dfa0469b423c8bfbdf64
Formbook
1d6b4c596e189a78ffd872bffe908aaf27f74f6c36dddfd50b517f9155c0938b
Formbook
1fc8a3262a1c12fd2ec5ffded3e5b8f83a14ebcbb1313e73900534ae42cc1ef8
Formbook
205522a02f43a8477a1ed81ea1dff4f5b914afbc01f68ac082e5bf76d73fe8b2
Formbook
37fa0d1153831bdf8c08560d18a83afc2ccede848883819536eb81497c63229f
Formbook
7044d232a489bff666d788729e41db7c74ad7f0d94f1a212fce0694855ecd899
Formbook
a4d4e093896e53df94a4ffb14632be70329334ac705925a975fa499ac7ee0a89
Formbook
b7f9546fa9fb928d856b69a70174d693a84c641ad193e88e48c07cdb92751e03
Formbook
e6d2c97461c6aac9ea130eaa96f9927b57998c04b5e7573a555caa729178a70c
Formbook
+ 2'608 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201022-cv4w65myra/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Gathers network information
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.mxmsportsgear.com/dfr/
Unpacked files
SH256 hash:
7843242690547cf0b4ebea118783c903b99c3a211f1775db3cf24b09fbe2454a
MD5 hash:
2e15b0340269d155525dbdf2c3d4ea16
SHA1 hash:
358f37517e4624678182e8f70a135dcee9f1052a
Link:
https://www.unpac.me/results/ef33eece-5b76-4581-b7a1-056d50ca67a0/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/ef33eece-5b76-4581-b7a1-056d50ca67a0/
SH256 hash:
60bbe6fbd19966a7432574d4a172f5f1acda452f602f39a17542ec873b23cd7f
MD5 hash:
65dbf2575090970cba57100e816245e4
SHA1 hash:
a186388ae7c27c9a4093a54596acd67af02092a0
Link:
https://www.unpac.me/results/ef33eece-5b76-4581-b7a1-056d50ca67a0/
SH256 hash:
5471221d05c4363d2dcb8eea16133e78c54b0ae1d9169cc7d8d75df8a71658b1
MD5 hash:
884036c323f9ac728697f9b8449f17cd
SHA1 hash:
65eaa89e5651c5d1301f940898ebb5d184fcec9a
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/ef33eece-5b76-4581-b7a1-056d50ca67a0/
Parent samples :
205522a02f43a8477a1ed81ea1dff4f5b914afbc01f68ac082e5bf76d73fe8b2
37fa0d1153831bdf8c08560d18a83afc2ccede848883819536eb81497c63229f
0c3afc73b1560d5d817104a616325e9f7a825e6b0158dfa0469b423c8bfbdf64
b7f9546fa9fb928d856b69a70174d693a84c641ad193e88e48c07cdb92751e03
7843242690547cf0b4ebea118783c903b99c3a211f1775db3cf24b09fbe2454a
7538931bad1762c44d0d66ea730a3ca6c5acb18d326f3a2f5bffa1f81864354e
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz dc1ad1b89ac56f0d92b0553839639dc1b85c4a9f7e333dc92f2e0abb12e1ebd3

Formbook

Executable exe 7843242690547cf0b4ebea118783c903b99c3a211f1775db3cf24b09fbe2454a

(this sample)

  
Dropped by
MD5 61dc5c2e2f5146a6e60d4de4b95b1d16
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/74543/
  
Dropped by
SHA256 dc1ad1b89ac56f0d92b0553839639dc1b85c4a9f7e333dc92f2e0abb12e1ebd3

Comments