MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fa9dd16bb791bea50566208c8b216acc3c41e5c65495f34c3dcf99c595fccc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fa9dd16bb791bea50566208c8b216acc3c41e5c65495f34c3dcf99c595fccc8
SHA3-384 hash: ef976e3398c612bafbbb8706b7525d9441b0e24ceeec9ddc3142395af4d2cd47928abefde7621c1b422322c19d64e1fb
SHA1 hash: 5e0d777a5e5f7fd2f1de81978de9f83d813aa6dc
MD5 hash: 518c0be4c7ebc6ec4929b6eceac36b9e
humanhash: thirteen-paris-alanine-leopard
File name:Communication delays dev. packaging 0325037377.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:831'488 bytes
First seen:2020-08-04 11:06:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:V6SccT4NI3yGgf1X1B8eWpIMAW4K0cPgYxmOE+2Do4pPeRH89fuDVx:V6dcT4+iFFiLpAwIYxPeVZl8V
Threatray 4'839 similar samples on MalwareBazaar
TLSH BC05AEC1F5409D50D82A4E3B893389914B33AC6BEF42D607349CB6592BF72C66A75F83
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: brenntag.es
Sending IP: 103.133.106.216
From: nordeste@brenntag.es
Subject: Communication delays dev. packaging 0325037377
Attachment: Communication delays dev. packaging 0325037377.r00 (contains "Communication delays dev. packaging 0325037377.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38540/
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.17670.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a file
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/409186
Signature
Benign windows process drops PE files
Creates autostart registry keys with suspicious names
Detected FormBook malware
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 256853 Sample: Communication delays dev. p... Startdate: 04/08/2020 Architecture: WINDOWS Score: 100 52 www.sedmxl.men 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Yara detected FormBook 2->56 58 Machine Learning detection for sample 2->58 60 2 other signatures 2->60 11 Communication delays dev. packaging 0325037377.exe 1 2->11         started        signatures3 process4 file5 44 Communication dela... 0325037377.exe.log, ASCII 11->44 dropped 14 RegSvcs.exe 11->14         started        process6 signatures7 74 Modifies the context of a thread in another process (thread injection) 14->74 76 Maps a DLL or memory area into another process 14->76 78 Sample uses process hollowing technique 14->78 80 2 other signatures 14->80 17 explorer.exe 4 9 14->17 injected process8 dnsIp9 46 www.funpexw.com 63.250.45.230, 49746, 80 NAMECHEAP-NETUS United States 17->46 48 www.makrobet909.com 17->48 50 www.bbetmoose.com 17->50 38 C:\Users\user\AppData\...\autochkv09l_rvh.exe, PE32 17->38 dropped 62 System process connects to network (likely due to code injection or exploit) 17->62 64 Benign windows process drops PE files 17->64 22 msiexec.exe 1 17 17->22         started        26 autochkv09l_rvh.exe 2 17->26         started        28 autochkv09l_rvh.exe 17->28         started        file10 signatures11 process12 file13 40 C:\Users\user\AppData\...\LM7logrv.ini, data 22->40 dropped 42 C:\Users\user\AppData\...\LM7logri.ini, data 22->42 dropped 66 Detected FormBook malware 22->66 68 Tries to steal Mail credentials (via file access) 22->68 70 Creates autostart registry keys with suspicious names 22->70 72 4 other signatures 22->72 30 cmd.exe 1 22->30         started        32 conhost.exe 26->32         started        34 conhost.exe 28->34         started        signatures14 process15 process16 36 conhost.exe 30->36         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8fa9dd16bb791bea50566208c8b216acc3c41e5c65495f34c3dcf99c595fccc8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:08:09 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r6u52fv3pen6uucwmiemrmqwvtb4ihs4mvev6ngd3t4zywk7ztea._file
Verdict:
malicious
Similar samples:
1bfdb7e4f0aadba330b6017c2608570e791bfddff789d128ecb5ca9a5a06e6fe
FormBook
442452b82edb2b18431c296669c78df1c88b210775e9a9b5d7726a1092a8fc6f
FormBook
6ff25388a91cbed0a11467e592e39e34c54de49d61876a2a201554e67c5b8cb4
FormBook
7bee02185a682294214d68a1c41ed3e0ebc53b275b200fd8b4a03fc92e1c463a
FormBook
854146ab0835f912d31018649e0f97ebde7a2267ec1085a36bc0dc73f5b6f2a9
FormBook
d6cfa16240c572c1d310d0e3f9a3a48254103dbfdaf47d08b31bd255a6022d50
FormBook
db31ede125999d44d9c886d76eb8d5c5ee280f17130e3e3138bf1f76935d1b99
FormBook
dda62be10b5d6c904c056f244d721e7dfc5bd60d033992a4763fb1105e0c334f
FormBook
ec34c3db0d2c865486e52760c0d35dab95adcb3544f2e03f5023495d112d64ba
FormBook
f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e
FormBook
+ 4'829 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200804-5ja7nztb96/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8fa9dd16bb791bea50566208c8b216acc3c41e5c65495f34c3dcf99c595fccc8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

r00 ac2793ce383523ab97126e94e6299e0ccbc47f2bec94f9f2f91bb69f1c4a6ede

FormBook

Executable exe 8fa9dd16bb791bea50566208c8b216acc3c41e5c65495f34c3dcf99c595fccc8

(this sample)

  
Dropped by
MD5 c0212209b524fc9b1d0ec23f7222079c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38540/
  
Dropped by
SHA256 ac2793ce383523ab97126e94e6299e0ccbc47f2bec94f9f2f91bb69f1c4a6ede

Comments