MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bf3bb9e44490d5836c31036a78c59c92a51d8f6bfb33363d8c617d27967ff3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bf3bb9e44490d5836c31036a78c59c92a51d8f6bfb33363d8c617d27967ff3f
SHA3-384 hash: b6f3a3d8029a4f397010a5a9c56d83285f574e5193c91db975ad95e1edd35fba2a708a606efc29afe1f85c4c546b6f2b
SHA1 hash: 7c86106022e7b4150d0ba2709f4df368c4b8bc15
MD5 hash: 2b71bd4f414944163720bffe66296f21
humanhash: beryllium-item-arkansas-angel
File name:W21_0191,pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'088'000 bytes
First seen:2021-01-19 12:52:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:053q3J/CelpgYUGw58+JgG3Sr2BqPMl7rnJ4wYbS:Ia30eTgYUnCk3G2rJ4wYbS
Threatray 3'576 similar samples on MalwareBazaar
TLSH 7135AE0122887F58F1BD5B3799A8545197FEFC01AB21CD2EBCE538DD59B2B92A607303
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.olitec.cloud
Sending IP: 93.186.252.9
From: Selena Lei <info@ledluxor.com>
Subject: Offer Request / W21-0191
Attachment: W21_0191,pdf.iso (contains "W21_0191,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
W21_0191,pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-01-19 13:00:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/38e64c84-d047-496c-8616-a194607e3663

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/112873/
Result
Verdict:
Clean
Maliciousness:
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/584968
Signature
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 341515 Sample: W21_0191,pdf.exe Startdate: 19/01/2021 Architecture: WINDOWS Score: 100 45 www.s-sgasia.com 2->45 47 s-sgasia.com 2->47 55 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->55 57 Found malware configuration 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 10 other signatures 2->61 11 W21_0191,pdf.exe 7 2->11         started        signatures3 process4 file5 37 C:\Users\user\AppData\RoamingrUoKVSz.exe, PE32 11->37 dropped 39 C:\Users\...rUoKVSz.exe:Zone.Identifier, ASCII 11->39 dropped 41 C:\Users\user\AppData\Local\...\tmp4D10.tmp, XML 11->41 dropped 43 C:\Users\user\...\W21_0191,pdf.exe.log, ASCII 11->43 dropped 65 Tries to detect virtualization through RDTSC time measurements 11->65 15 W21_0191,pdf.exe 11->15         started        18 schtasks.exe 1 11->18         started        20 W21_0191,pdf.exe 11->20         started        22 2 other processes 11->22 signatures6 process7 signatures8 73 Modifies the context of a thread in another process (thread injection) 15->73 75 Maps a DLL or memory area into another process 15->75 77 Sample uses process hollowing technique 15->77 79 Queues an APC in another process (thread injection) 15->79 24 explorer.exe 15->24 injected 28 conhost.exe 18->28         started        process9 dnsIp10 49 www.bifa510.com 23.107.183.70, 49754, 80 LEASEWEB-USA-LAX-11US United States 24->49 51 joinmytradingteam.com 34.102.136.180, 49750, 49756, 80 GOOGLEUS United States 24->51 53 4 other IPs or domains 24->53 63 System process connects to network (likely due to code injection or exploit) 24->63 30 colorcpl.exe 24->30         started        signatures11 process12 signatures13 67 Modifies the context of a thread in another process (thread injection) 30->67 69 Maps a DLL or memory area into another process 30->69 71 Tries to detect virtualization through RDTSC time measurements 30->71 33 cmd.exe 1 30->33         started        process14 process15 35 conhost.exe 33->35         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9bf3bb9e44490d5836c31036a78c59c92a51d8f6bfb33363d8c617d27967ff3f/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:55:00 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tpz3xhsejegvqnwdca3kpdczzevfdwhwx6ztgy6yyyl5e6lh747q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
14ee2894b546ba6d7835ee4dd8e07ef72fb10bfaebec8f1687da4559267cb72e
Formbook
5c7b804890877a7a9da085d878b0fc1a444aa1b75965e16beab74c978fab6079
Formbook
6b112d62c9d5722e71733aebafd86f5ac0a45c71a6776650f9505e239b7d8f8e
Formbook
98be979a6ee314a1829acd3d33744d9caf8fe2c871d6b73d3771c76c09584387
Formbook
c3d490568e73f61c86d2d4c01e170bdcf3c0d3eb5e309ff3d3fb808a4a867a54
Formbook
cf6959fe2bb4c2e078a8bb51c097dfd79bc0ca5cd296090a897ecb30a3ee6102
Formbook
e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6
Formbook
e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae
Formbook
f53df4e1f9405d98a02cf34bedf2ee5df88437c130eb339eb6da9850f14ad443
Formbook
f8a388fc032aa7fdf80ed5bad850e3429ee27614bd6152efaa090fc77ad3bc6a
Formbook
+ 3'566 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210119-sd1kp66qhs/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.radissonhotelsusa.com/cp5/
Unpacked files
SH256 hash:
5fb47a93e8f99354f497567e1f3e58ba78e76db73bd1415f2d7513ab89f29cb7
MD5 hash:
6f2f98ed322c76eba6ed310fee5c551e
SHA1 hash:
5ddc2d41bbcc90b734581178065b4784330a33c0
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/0d16e3ab-b42e-40a2-bae5-17e8222ee6cb/
Parent samples :
134447d4a42fa0c68719a166022b19728ab3b771a025fcb40b9e01eb0472bd8b
e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae
9bf3bb9e44490d5836c31036a78c59c92a51d8f6bfb33363d8c617d27967ff3f
SH256 hash:
52d35fabfc97d3e903b5d9eb253e8f84d1dfee2967fa9dde6d6ca37cc61951c5
MD5 hash:
b5a7f2596efe4c5fc5f5d2c733d49259
SHA1 hash:
c121578124375dc293e4daf12fac22442a8131b6
Link:
https://www.unpac.me/results/0d16e3ab-b42e-40a2-bae5-17e8222ee6cb/
SH256 hash:
ce4938db19db0117e6a5cf01101502ff7c194049238f4e26032161c8ac7be07e
MD5 hash:
7f6b0506f84d3fff7f0d5bb00ff2036a
SHA1 hash:
66692e1dfb7c217acfc59263a3ff56da63b6cdc2
Link:
https://www.unpac.me/results/0d16e3ab-b42e-40a2-bae5-17e8222ee6cb/
SH256 hash:
9bf3bb9e44490d5836c31036a78c59c92a51d8f6bfb33363d8c617d27967ff3f
MD5 hash:
2b71bd4f414944163720bffe66296f21
SHA1 hash:
7c86106022e7b4150d0ba2709f4df368c4b8bc15
Link:
https://www.unpac.me/results/0d16e3ab-b42e-40a2-bae5-17e8222ee6cb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9bf3bb9e44490d5836c31036a78c59c92a51d8f6bfb33363d8c617d27967ff3f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso fd78858f7f4189225471974edbc7753694532cc277e5678f711621fc17f95632

Formbook

Executable exe 9bf3bb9e44490d5836c31036a78c59c92a51d8f6bfb33363d8c617d27967ff3f

(this sample)

  
Dropped by
MD5 7354153812556a7ba071fc3f6fa5b2b4
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/112873/
  
Dropped by
SHA256 fd78858f7f4189225471974edbc7753694532cc277e5678f711621fc17f95632

Comments