MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25
SHA3-384 hash: 61ac253b48d2fc8396748dd8d7ea6afa875377ef4c92b1fd6190e63e75b85fdd7f82b5ff1a3441435b905e9642006601
SHA1 hash: bd33c35a9d268f9c29a30415ef94f5d4853487b6
MD5 hash: 64bb9b8f6800fe0d658195ebfb066518
humanhash: stairway-moon-video-may
File name:request_quotes.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:750'592 bytes
First seen:2020-10-22 07:40:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:NRlWIqf6QTPO7DGJZ6AoKUItu2HeCgEbpfaROZO5YiyZhRb5NiWQBtEvXSta8O+Q:D9R0EyTRdAPKF8V
Threatray 3'692 similar samples on MalwareBazaar
TLSH 8DF48DDC726072EFC85BD4729EA81DA4EA6164BB831F5203A02716EDED4D897CF144F2
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: server.blakecorporations.com
Sending IP: 199.250.204.180
From: M Hanif Azis (malaysia) <Azise.hanif@petronas.com.my>
Reply-To: M Hanif Azis (malaysia) <purchase2@workmail.com>
Subject: request quotes_urgent_purchase
Attachment: request_quotes.zip (contains "request_quotes.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74547/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 02:43:56 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uuh57uvftsx6epgucit3izoujnwqbyvrj5yhpggwbutdp73y54sq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
4636055b5170ddb11d94a466c0c93e57ad40caf68a036274bdf2ded620a22bce
Formbook
6bb732e1c22295b2fa6970a286225d14bd7c6fabef714f9b20c3a622bb8e7645
Formbook
75f121f9048171649f3ba28afcd30a1dcd668266717b0d98e8bac88afe411fe7
Formbook
767fc756f86db0b4de57b4ec14964f24af0e47eb23ba7fa1df6378bcf9986947
Formbook
805a071c8e38fca4e3602881ff33ac7a2afba65bb61cd7adda873950bf2779cb
Formbook
867ec49152a23a8e5ea628a48ec1810db588a716b922e6d1c8e7c45116908d24
Formbook
bdad93534a202f7d3c2f102dc39093fa12a32f5de82c76a5fb41a94e1748d99e
Formbook
c8cd524c89b904ad199b97a7740a9928abd939107904bb29150cdfd98f0f7404
Formbook
d325c45529e7211242f65cabe3549dd635a23fc43b48c2b2a64ccff8d54c1ee2
Formbook
e5a94739fb1f6d7a06f6b9eb529037c9ab0d59be424d4b99c63651360d7ded3f
Formbook
+ 3'682 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201022-jneas6d52a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.thehappyhourtimes.com/z0po/
Unpacked files
SH256 hash:
a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25
MD5 hash:
64bb9b8f6800fe0d658195ebfb066518
SHA1 hash:
bd33c35a9d268f9c29a30415ef94f5d4853487b6
Link:
https://www.unpac.me/results/9caad3ca-f715-4d0c-8667-75a1d767f523/
SH256 hash:
4893c13af233e6f13bf525da5c8b05cc3bf8fac9b21f8ef41753a63bab0f0831
MD5 hash:
03bdf9bd99907f064ef3c2deddc83a05
SHA1 hash:
00fd3f508abc9a997d0eed6ecba21ee885355da1
Link:
https://www.unpac.me/results/9caad3ca-f715-4d0c-8667-75a1d767f523/
SH256 hash:
cd9aa1779c6139f6f3a6666d5ff1327974b03b6fe03b09864ae99d5a306bce2f
MD5 hash:
4632dc0448cc06a669875eabb372c89e
SHA1 hash:
6ede2c60fe0e4b5d652e293ac0940c57e380e506
Link:
https://www.unpac.me/results/9caad3ca-f715-4d0c-8667-75a1d767f523/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/9caad3ca-f715-4d0c-8667-75a1d767f523/
SH256 hash:
c772626ba0fbd168cb8e32928a3918f06b9bd8e88500b493793d3743dea07397
MD5 hash:
510f6e8b776fe59ff1e58451ab41db68
SHA1 hash:
fd12e1b560834d999128570ff115117ff77ed786
Link:
https://www.unpac.me/results/9caad3ca-f715-4d0c-8667-75a1d767f523/
SH256 hash:
bede79bf25ca010c286de6d88867a6303393b252b4b74ebdea06fd37f488a2ba
MD5 hash:
431312d51feb08bd4e11406adee8ad42
SHA1 hash:
70b08626aa49497d006195e3d74e71776f5724ab
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/9caad3ca-f715-4d0c-8667-75a1d767f523/
Parent samples :
e5a94739fb1f6d7a06f6b9eb529037c9ab0d59be424d4b99c63651360d7ded3f
867ec49152a23a8e5ea628a48ec1810db588a716b922e6d1c8e7c45116908d24
a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25
2fe26662d53b976914fd7bd9fbb589f5bd4114f47753c9437593b29fcd04c236
106bfa0280569ce313c19beb1c68515fb148212a033fdd96ef075d38256f5fb9
c698f5ef823adc2c3079ee359ea6d80e7c8e800d742d8f63c4c6f697131dd763
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 02d2a682471b48f805b464007597ae477ee5ac10fde16f9e71a57174e47c8230

Formbook

Executable exe a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25

(this sample)

  
Dropped by
MD5 03a0f7b18a2a74d9a3c87979907c21ef
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 02d2a682471b48f805b464007597ae477ee5ac10fde16f9e71a57174e47c8230
Cape
Cape
https://www.capesandbox.com/analysis/74547/

Comments