MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90afcb6b9e301d7081737182f7f3e3bff751ba972d161d8da5c24db1d0d36dc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90afcb6b9e301d7081737182f7f3e3bff751ba972d161d8da5c24db1d0d36dc0
SHA3-384 hash: b47e055052b306d08c014631c7c5055ae772425bed9d9cd5551e25140ef4189c50068e6ba44a8a9df4fed0944c5b7194
SHA1 hash: 63ac2ac4e94d66d285968035c55f02917c419744
MD5 hash: 2bf247b62106faa756c070c4e017d402
humanhash: helium-happy-cardinal-double
File name:ETOS project Specifications.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:749'568 bytes
First seen:2022-10-03 13:19:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:MmAzQsRZDsItEVJ6AKJQ84lSt0/2V+4HPI/yCfJuZXLN1:+zQswikDD5lSt0+ZQKUJuZ7N
TLSH T10CF4DF371BEA8B0BE165767881D1D2F6A7A9CC10E477C6976FCA5C1FF08A465DB20320
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
245
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316109/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.389.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
azorult formbook packed
Link:
https://www.filescan.io/uploads/633ae183d5955f6f49d5cfcb/reports/1c9f1208-4e3d-4cfa-a45f-3da6651784fc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/64e27359-5528-486f-ad40-ed52f39c23da
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1082487
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 715047 Sample: ETOS project Specifications.exe Startdate: 03/10/2022 Architecture: WINDOWS Score: 100 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Yara detected AntiVM3 2->40 42 7 other signatures 2->42 10 ETOS project Specifications.exe 3 2->10         started        process3 file4 30 C:\...TOS project Specifications.exe.log, ASCII 10->30 dropped 52 Injects a PE file into a foreign processes 10->52 14 ETOS project Specifications.exe 10->14         started        signatures5 process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 Queues an APC in another process (thread injection) 14->60 17 explorer.exe 14->17 injected process8 dnsIp9 32 www.celebrate-the-date.com 17->32 34 celebrate-the-date.com 34.102.136.180, 49708, 80 GOOGLEUS United States 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 cmstp.exe 17->21         started        24 autochk.exe 17->24         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 26 cmd.exe 1 21->26         started        process13 process14 28 conhost.exe 26->28         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/90afcb6b9e301d7081737182f7f3e3bff751ba972d161d8da5c24db1d0d36dc0/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-10-02 07:07:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=scx4w246gaoxbaltogbpp47dx73vdouxfulb3dnfyjg3dugtnxaa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:vo84 rat spyware stealer trojan
Link:
https://tria.ge/reports/221003-qk3ycahacl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook payload
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d799ce33-8584-45d3-ad67-07a00e89fe94
Unpacked files
SH256 hash:
c7449648d74edcbfb5c730f4be3c8ba5249bcf89b3de43d7825e688809599bb4
MD5 hash:
6f26fd733aba9c2b4e3a78ab2f8a1656
SHA1 hash:
45dcc917eebeee4053cc7c329d4ce19fb34a1395
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/96c146f5-9a3f-4674-b234-68dcaa24a0af/
Parent samples :
73de38a06d84d51fd173c71af2ef473703a3cfe94792a4e3bc383c528b7b3192
90afcb6b9e301d7081737182f7f3e3bff751ba972d161d8da5c24db1d0d36dc0
92954dc78f56ef75d0121624516e7556131aa6950094007398dd61194e1b8198
7f57baf941771509bb5f2b09a099e2b5a302c8892d5bdb65adcf47a8d4ecc64f
59cb035dba6e6398c3edf4fc56fb6ef4092a6326d8b7b53dbd3460b9456ef90b
SH256 hash:
2470b39032f6182252039c88199016566b0de30c6aa02163a143427afedd12af
MD5 hash:
c3a1924684ca30ed22234ce1d9111dfc
SHA1 hash:
7347706241422758c06440fd6044ae4e042b456b
Link:
https://www.unpac.me/results/96c146f5-9a3f-4674-b234-68dcaa24a0af/
SH256 hash:
f8e8b2dbdda6357f4be625905b8f09fd05fc862e3fb0c9272da682e547aa9c52
MD5 hash:
abb1e19931863ce307a4e2e3d2129d55
SHA1 hash:
13d04a7769d7dc00620c28061f6bde6beb355b30
Link:
https://www.unpac.me/results/96c146f5-9a3f-4674-b234-68dcaa24a0af/
SH256 hash:
5e5d107a32129c3ed5e1ca967c8fb237b86f3b396fda4f71c32fe678ecd59070
MD5 hash:
f65f9a459413bd31d6ed6971493c0bb2
SHA1 hash:
0a7eb75090aa244910d55a7ab0e74c5d43cbf929
Link:
https://www.unpac.me/results/96c146f5-9a3f-4674-b234-68dcaa24a0af/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/96c146f5-9a3f-4674-b234-68dcaa24a0af/
SH256 hash:
90afcb6b9e301d7081737182f7f3e3bff751ba972d161d8da5c24db1d0d36dc0
MD5 hash:
2bf247b62106faa756c070c4e017d402
SHA1 hash:
63ac2ac4e94d66d285968035c55f02917c419744
Link:
https://www.unpac.me/results/96c146f5-9a3f-4674-b234-68dcaa24a0af/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/90afcb6b9e30/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/90afcb6b9e301d7081737182f7f3e3bff751ba972d161d8da5c24db1d0d36dc0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_imphash
Create hunting rule
Rule name:RansomwareTest8
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/316109/

Comments