MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659
SHA3-384 hash: a00f47a3219afe933cc5573072ef9ff8e32caf45b1e43619230543d015a02e578d8cbe155631951900522b65e2f81eeb
SHA1 hash: 746586a9e3ce1f3482cd842afc0e14c809c87637
MD5 hash: 58d888e82f4acf1355848ce4b72cef99
humanhash: fourteen-ack-thirteen-hotel
File name:Quotation.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:509'440 bytes
First seen:2020-10-15 13:53:59 UTC
Last seen:2020-10-15 14:48:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:OTbHDdiSG0ahtIQ1Cp3Ct+2aN9Bp4CLhekeIL:OTrDxahtz1tttaDBp4tTo
TLSH 68B4AE727992D93FCA6A07351D7D85C5F6B616C63B908B0D726E8F4CCE01B2BA743242
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: tele-grup.ro
Sending IP: 46.102.249.123
From: luminita@tele-grup.ro
Subject: Re: New Order
Attachment: KM_226_01669.img (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71434/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.3313.454.5822.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Sending a UDP request
Creating a window
Creating a file
Creating a process from a recently created file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/492581
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Allocates memory in foreign processes
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659/
Threat name:
ByteCode-MSIL.Dropper.Dorifel
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 05:09:22 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkmq3kxlenw2y73civrg5evemjghtc4j5fwvoov726gswvdk6zmq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201015-scet1y7m2n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.progressaofinanceira.com/di4r/
Unpacked files
SH256 hash:
7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659
MD5 hash:
58d888e82f4acf1355848ce4b72cef99
SHA1 hash:
746586a9e3ce1f3482cd842afc0e14c809c87637
Link:
https://www.unpac.me/results/33d9e42f-9bfa-4d5c-832b-3251b4330cfc/
SH256 hash:
30140c3bf5874d7d184b15513016f9de1524ae95a5efe9a1cb15bad6d6936d64
MD5 hash:
03847d82611bc6461cbb99ca768828f1
SHA1 hash:
39859a3fd3326520dfd1ed10456bb227933a8871
Link:
https://www.unpac.me/results/33d9e42f-9bfa-4d5c-832b-3251b4330cfc/
SH256 hash:
39c99a9539b034719e14fbc488c2268a2e935dbd0f1162badf898dbdda4eb12d
MD5 hash:
969c10802f9afcd802e938fb49593827
SHA1 hash:
a02f21f1031be8da4bbeb977a0a02a8bb602da40
Link:
https://www.unpac.me/results/33d9e42f-9bfa-4d5c-832b-3251b4330cfc/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/33d9e42f-9bfa-4d5c-832b-3251b4330cfc/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
SH256 hash:
290a2a2881ff015d555649d59c2ddeebe3b9536eb8ed06f09f185990edda31b4
MD5 hash:
bc4c20d803c773fbd897ddcc34d8175f
SHA1 hash:
78d279a93dbf815b30b15f7e0cd223e659c259c3
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/33d9e42f-9bfa-4d5c-832b-3251b4330cfc/
Parent samples :
7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659
74ee80ac61ce369a23feac3296a825873aa257282d5dd0f9c35c385e3d6766cf
a9a6a44f3eca95cc7785debebea767461798f27978628c58a06474005b8855c8
366d589602fe9abe8051f7b13322aaa0efc3d65638575bc6488a65ce75773488
e193e31155334803c7114e1f578689e26cda3faf7539fdb15d19f2f60e8379c1
bd53fc041a6e364f163c70e2bcf38a1565f3764a31b8c94de466fce780f9ab71
496312b0f2439d09765eb76ce146369b9417f59225f86c9b5f0ef8e1bb880602
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 9e4ca58336a1b240cb1da03e9140f2aaa10f726cebf52f32af140bab603a1ef3

Formbook

Executable exe 7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659

(this sample)

  
Dropped by
MD5 06a30345627f6c8053d1bd305e7b7bed
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71434/
  
Dropped by
SHA256 9e4ca58336a1b240cb1da03e9140f2aaa10f726cebf52f32af140bab603a1ef3

Comments