MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e816e44eb6ebdc6b99876142caba3fc1f8a0633edec29e8c1ae3f57e1ca55c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	8e816e44eb6ebdc6b99876142caba3fc1f8a0633edec29e8c1ae3f57e1ca55c9
SHA3-384 hash:	8f8b3d623e61b9367a0223d0cc8602a2251bd5dae3a06af80d17f2b77bdc73e75816cebb3e7d96a6c7ca4c362b2928a7
SHA1 hash:	6f7520b92cfab9a5be6846c62c512bcf88fc2c77
MD5 hash:	5d835e5f1204b33ad2b2cda5313676aa
humanhash:	tennessee-nine-hydrogen-pizza
File name:	469nGuFQyVJyw0O.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	544'256 bytes
First seen:	2020-10-27 08:46:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:EiyHGyUs14azXgou5ZB8gVh9OgRspcZV03Jq8HcD+jr:MHGHazgoEZqyLOgOpB3Uuc6j
Threatray	2'720 similar samples on MalwareBazaar
TLSH	93C402B4FCE1FAA7C3988EB760A5663847F1681BC726D908CA72FAD245C57400764CB7
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing Formbook:

HELO: EUR06-VI1-obe.outbound.protection.outlook.com
Sending IP: 40.92.17.69
From: mahakanbar323@hotmail.com
Subject: Purchase Enquiry 6767
Attachment: Purchase Enquiry 6767.rar (contains "469nGuFQyVJyw0O.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/79701/

Detection(s):

SecuriteInfo.com.Trojan.InjectNET.14.16448.21412.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Launching cmd.exe command interpreter

Setting browser functions hooks

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/513061

Signature

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious Svchost Process

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8e816e44eb6ebdc6b99876142caba3fc1f8a0633edec29e8c1ae3f57e1ca55c9/

Threat name:

ByteCode-MSIL.Backdoor.NanoBot

Status:

Malicious

First seen:

2020-10-27 00:21:13 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=r2aw4rhln264nomyoykczk5d7qpyubrt5xwct2gbvy7vpyokkxeq._file

Verdict:

malicious

Label(s):

formbook

Formbook

0bfa5712201676e9439c4624fd99b8ec2bba95ccd53fb67f0a289b0a8347fc7c

Formbook

4bb2bfa075e9870bbf9ee55dc7bf9a76f3405245380f2183d0b71fad9e9114ad

Formbook

680e6e46c8bed6c48e63f6dab3409bb9cd05f6642084ef8b0d03898dacc500a7

Formbook

ade5a7d8aab5f80cf5b8b97c2bdf22922ef7fafa749b2eb7f1655b0349886196

Formbook

b9fa08af8ceadc9af473f443a5b8c8d0f3e40324df53c81a5da4f97ef946e160

Formbook

bce2ea2d104a5da7bfa34d0a5157893ae62b5d009783e62e7a557a22ba0c807a

Formbook

eacd132f69b64ef7a47c959fd92f50343be23e5768f0476c665870f5de4f89ee

Formbook

f755a2e09db3f63b7e9c035a488652b00ccb0678eca144db82e84e9e34345deb

Formbook

fd5aa67ff2ae6837aaf729665b08947c23a7b5cbb1f0c9fba82ebb95ddafcf24

Formbook

+ 2'710 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

rat trojan spyware stealer family:formbook

Link:

https://tria.ge/reports/201027-2dgpnwar92/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Deletes itself

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.bfboke.com/cpi/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time