MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78e458ae8ef10267738b8b1b1591fc5ace8bbb126d415124b1f067ad98a4801e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78e458ae8ef10267738b8b1b1591fc5ace8bbb126d415124b1f067ad98a4801e
SHA3-384 hash: c45d43a6ee58042f45a7629b309b4dfbd2ef167bcc6683457728da693f7eacefd9a7aabd1f74b24f982016186e7b5885
SHA1 hash: 41086c2288b6a1b2b19211128c260cad59973bc2
MD5 hash: 45507c31a00a17d1c0cc6779f9f675d3
humanhash: kentucky-florida-quebec-cold
File name:Closing Balance.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:668'672 bytes
First seen:2021-04-13 10:47:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:hxXplQKY8+gCAq1rMyon/oNSG49O7/RmELIvAE0UHk9HuPiHGkaq:/3HYvdAq1Qyon/ASGqa9LjE0dHuP+GN
Threatray 4'649 similar samples on MalwareBazaar
TLSH BEE4D0E42A06D72CD978ABB8084541F133F37C1196D9CAC57EC43E5E7967202C2EF6A6
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Closing Balance.exe
Verdict:
Suspicious activity
Analysis date:
2021-04-13 10:51:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6411f1f3-a781-4f42-b352-082a7c90a5d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133945/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.646-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/674169
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 386030 Sample: Closing Balance.exe Startdate: 13/04/2021 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->36 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 9 other signatures 2->42 10 Closing Balance.exe 3 2->10         started        process3 file4 28 C:\Users\user\...\Closing Balance.exe.log, ASCII 10->28 dropped 52 Injects a PE file into a foreign processes 10->52 14 Closing Balance.exe 10->14         started        signatures5 process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 Queues an APC in another process (thread injection) 14->60 17 explorer.exe 14->17 injected process8 dnsIp9 30 motherhenscoop.com 160.153.136.3, 49756, 80 GODADDY-AMSDE United States 17->30 32 californiaadugurus.com 184.168.131.241, 49754, 80 AS-26496-GO-DADDY-COM-LLCUS United States 17->32 34 4 other IPs or domains 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 cmstp.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/78e458ae8ef10267738b8b1b1591fc5ace8bbb126d415124b1f067ad98a4801e/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2021-04-13 10:48:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pdsfrluo6ebgo44lrmnrlep4llhixoysnvavcjfr6bt23gfeqapa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
17bb7657e5e89ebadc0d65b4dbb539c2ce5a9b3ea834db2da17ce427d5ef0670
Formbook
229e96e1a3477d1153de8104751eca8b433669d7e80713530a9668909c07918b
Formbook
5956f2c88cbbb0b5d84c8e074cb7a784688d30b367e22b62b62192d1dec597d7
Formbook
63834b5f21e4b9e36f69b48ddcdba7a8176f227ce4fdb290fe59e1ff9aa7a4f6
Formbook
b47a61d16376e7b825ec4b7eaa988247644b49ecbe80164b83424a65c014cc05
Formbook
b7d74de8e9514ca3fbfa4676be4433069bc913f86953a79d40c6272d5077242c
Formbook
bd5ca223f31f19c9f72102f04c8dcbc6ef6514aa02fefc0b8a937b16ef55cb3a
Formbook
c4b88f2cd48afe278bcaa30561bfc0390f96ec9660f9790108b03feee44ad75b
Formbook
f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
Formbook
f782d415e7975acdf521b8a92ceb1e1f5c51c030dfdfdf5d798ad381003ed1bf
Formbook
+ 4'639 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210413-8btddde5c6/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.the-techs.info/chue/
Unpacked files
SH256 hash:
5e0f3da625a479a5e7e807b5f09c889d95474139410b312ba3a39bcb05976729
MD5 hash:
3d20c2ea9ac04e1707f853bb1780bc18
SHA1 hash:
805e90b023eb92d44bbe11daefce6edbe872cb74
Link:
https://www.unpac.me/results/306113db-2615-49a6-8e4c-bc7b0b4c3cf9/
SH256 hash:
78e458ae8ef10267738b8b1b1591fc5ace8bbb126d415124b1f067ad98a4801e
MD5 hash:
45507c31a00a17d1c0cc6779f9f675d3
SHA1 hash:
41086c2288b6a1b2b19211128c260cad59973bc2
Link:
https://www.unpac.me/results/306113db-2615-49a6-8e4c-bc7b0b4c3cf9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/78e458ae8ef10267738b8b1b1591fc5ace8bbb126d415124b1f067ad98a4801e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 49c65c3ac340bc3cf7d356c5d9ab4dcad04de64908df63908cd29eaea002869b

Formbook

Executable exe 78e458ae8ef10267738b8b1b1591fc5ace8bbb126d415124b1f067ad98a4801e

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 49c65c3ac340bc3cf7d356c5d9ab4dcad04de64908df63908cd29eaea002869b
Cape
Cape
https://www.capesandbox.com/analysis/133945/

Comments