MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 879e1880a4d2d7f0245a1267cf5bd4447eab697eea8680aa96ecf73f8a2c78f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 879e1880a4d2d7f0245a1267cf5bd4447eab697eea8680aa96ecf73f8a2c78f5
SHA3-384 hash: 68927983913e6e9c120cf4c4272a9b3e9a1f299215217d7b19e0e67d67d5b10f04fc5936e645b6cabd6a6c8c2c69533a
SHA1 hash: aaf0c3dbc033e6f3e88a281887dedddb57dd68d4
MD5 hash: 66bb2294acd9355bc4153bb4beaea63f
humanhash: spaghetti-avocado-mars-network
File name:Quotation Request for 20ACAS__070S - CASCADE H7.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:482'816 bytes
First seen:2020-06-15 05:30:04 UTC
Last seen:2020-06-15 06:09:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:GV3xRVAO5hCKBIqZ0wicvo0do0HspWOn:qhRVA631Cjcvfdovnn
Threatray 4'898 similar samples on MalwareBazaar
TLSH FAA47D41F288DC9AE41719B248BFD930116A7F9D9175C60E324BBA2A59F3353206BF4F
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sungwon7.co
Sending IP: 111.90.158.36
From: Ann Ulenaers <purchase@wilbers-wilbers.nl>
Reply-To: purchase2@ltcompany.com
Subject: Re: Re: Quotation Request for 20ACAS__070S - Kn95
Attachment: Quotation Request for 20ACAS__070S - CASCADE H7.rar (contains "Quotation Request for 20ACAS__070S - CASCADE H7.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10212/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34016426.19424.29719.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:31:07 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6pbrafe2ll7ajc2cjt46w6uir7kw2l65kdibkuw5t3t7crmpd2q._file
Verdict:
malicious
Similar samples:
0f8acbcde0c3f0f60b101a72f778b7d29a9a799f607e4ec00aa28dc734d0fbfa
FormBook
3f86f49f3c2e3583c70385971bdba545c85d8f2d66f8923bf446dde88be3afc0
FormBook
4334ef4236c8a8b7c1c3463875315f16b35ba1d4dfac8c67f8c0cb81f950d850
FormBook
7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6
FormBook
9047151fe524a34dffeacd46eba66b4b0a87beb7f3e513ba8e5c6ca367ccc505
FormBook
9a4f09a04f936d38799360de7c824701e635ce56d7d014903a6934626c3042a0
FormBook
d34f87c6a070f4f73344156c16be7040f2932053aea2868e98b0fa4297113835
FormBook
e69790e910b1817bcfb714f20fda02b6e024babd3dfcea8fa982192928a5df93
FormBook
e99c6ae5a08e119d151f0c28b6b164d98ca6fd24d1d91b6f57bdf40f3d688c91
FormBook
f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510
FormBook
+ 4'888 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-xyxykkr1tx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of UnmapMainImage
System policy modification
Drops file in Program Files directory
Suspicious use of SetThreadContext
Deletes itself
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.flycoz.com/te/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 0f9e406e7b210ef087b0d8b047905cf32bac844d9a099372ffffe464719e0bff

FormBook

Executable exe 879e1880a4d2d7f0245a1267cf5bd4447eab697eea8680aa96ecf73f8a2c78f5

(this sample)

  
Dropped by
MD5 af4f4605bc2d076c52234d6fca71f7ae
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 0f9e406e7b210ef087b0d8b047905cf32bac844d9a099372ffffe464719e0bff
Cape
Cape
https://www.capesandbox.com/analysis/10212/

Comments