MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6b1721d8c0dde85f0b0bd080818c3c34616e990da2b879c3e3a01d8c56aaf6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6b1721d8c0dde85f0b0bd080818c3c34616e990da2b879c3e3a01d8c56aaf6c
SHA3-384 hash: 8fd1004112b93cbe2295a417c26991a83c888cd0d812d379b7c28df1593f01815b87bf962a4da55360c3b60489ce1a2d
SHA1 hash: cdaa468dbe021e3d07e1e4c4a091fe359e3fcc00
MD5 hash: 7a35fb75d04b42a54f75b5dc870739cb
humanhash: ohio-uncle-seventeen-pluto
File name:PROFORMA INVOICE.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:509'221 bytes
First seen:2021-11-22 13:45:20 UTC
Last seen:2021-11-22 15:49:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:KGinF1dMJm+Mxn2FwWqUjVMhG2fnUtQWxL36wAEZp5lEcESt4Iy:6RI22F0UjV6nUtLxOQ/YSqB
Threatray 11'447 similar samples on MalwareBazaar
TLSH T1E4B49A1B9D8C8A4AE6D40A73027E5A1592E58DFD2EA9CD4A9E443B95FD3303F25CF0C1
File icon (PE):PE icon
dhash icon 00802bd4c4238000 (1 x Formbook)
Reporter cocaman
Tags:exe FormBook INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: "Esin Kutlucan <info.advantech@iname.com>" (likely spoofed)
Received: "from ns1.omnis.com (unknown [38.103.244.230]) "
Date: "18 Nov 2021 14:24:38 -0500"
Subject: "PO/QUOTATION/INV/PAYMENT402200318"
Attachment: "PROFORMA INVOICE.exe"

Intelligence

File Origin
# of uploads :
3
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PROFORMA INVOICE.exe
Verdict:
Malicious activity
Analysis date:
2021-11-22 13:50:04 UTC
Tags:
installer trojan formbook stealer
Link:
https://app.any.run/tasks/c936641c-4152-46cd-99dd-033a05ed8483

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.45470.29885.11974.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
DNS request
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
Searching for synchronization primitives
Reading critical registry keys
Sending a custom TCP request
Setting browser functions hooks
Forced shutdown of a system process
Unauthorized injection to a system process
Unauthorized injection to a browser process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/619b9f1d398e2553d200d853/reports/bedf5247-103b-41dc-a200-22c3290cc0f0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1bab12dc-236e-4be8-b2be-07ce30a363e0
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/894119
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526596 Sample: PROFORMA INVOICE.exe Startdate: 22/11/2021 Architecture: WINDOWS Score: 100 34 www.peacepresidentunited.com 2->34 36 peacepresidentunited.com 2->36 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus detection for URL or domain 2->52 54 7 other signatures 2->54 11 PROFORMA INVOICE.exe 17 2->11         started        15 explorer.exe 101 2->15         started        signatures3 process4 file5 32 C:\Users\user\AppData\Local\Temp\...\qyux.dll, PE32 11->32 dropped 64 Injects a PE file into a foreign processes 11->64 17 PROFORMA INVOICE.exe 11->17         started        signatures6 process7 signatures8 40 Modifies the context of a thread in another process (thread injection) 17->40 42 Maps a DLL or memory area into another process 17->42 44 Sample uses process hollowing technique 17->44 46 Queues an APC in another process (thread injection) 17->46 20 explorer.exe 17->20 injected process9 process10 22 raserver.exe 20->22         started        signatures11 56 Self deletion via cmd delete 22->56 58 Modifies the context of a thread in another process (thread injection) 22->58 60 Maps a DLL or memory area into another process 22->60 62 Tries to detect virtualization through RDTSC time measurements 22->62 25 explorer.exe 2 151 22->25         started        28 cmd.exe 1 22->28         started        process12 dnsIp13 38 192.168.2.1 unknown unknown 25->38 30 conhost.exe 28->30         started        process14
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a6b1721d8c0dde85f0b0bd080818c3c34616e990da2b879c3e3a01d8c56aaf6c/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 17:47:23 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
29 of 45 (64.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2yxehmmbxpil4fqxueaqggdyndbn2mq3ivyphb6hia5rrlkv5wa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
10a4841b7d56afca3aad568e29fcd3c44f3a0d893aef62ee32471847be405797
Formbook
1ed21fc2049e9b5697a5d8ec374c41bcbf83c6210fab4d58b6bdf1282f44c739
Formbook
4f6a9d2f8c26c5106123e3684d72d2624e58226f0c845a265cadf80e67b49842
Formbook
5faf43a6f7999e59d5660ed1b485bb6be7a3cb80b753e0a644fd7bc282f7f6bf
Formbook
60f3b28c265ee86ff2fda42a3147348bf53971060d9b97e2cd631a32f80ee0cd
Formbook
79ff3adbc3c3d3bded849b527e4e0d8b0d0b8fb89479931eb18871ea3c74e1cb
Formbook
ba3c756c27b44d1cb989c1107cbefadcaf40be4b8186f1a8e4641c264e6dfb42
Formbook
ea074d89ce669e6d00d54a7fce58a5394a075611740346df298cb55926ac9a55
Formbook
ff64ff314c7947e5faae8181ac818b124a6d17d0fc3a66e8777a78a613d6093c
Formbook
+ 11'437 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:l3ld rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/211122-q2zbgsffbk/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Blocklisted process makes network request
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.peacepresidentunited.com/l3ld/
Unpacked files
SH256 hash:
a6b1721d8c0dde85f0b0bd080818c3c34616e990da2b879c3e3a01d8c56aaf6c
MD5 hash:
7a35fb75d04b42a54f75b5dc870739cb
SHA1 hash:
cdaa468dbe021e3d07e1e4c4a091fe359e3fcc00
Link:
https://www.unpac.me/results/d4bd6ca8-cc8d-4142-9aa4-a3af910131fa/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a6b1721d8c0d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/a6b1721d8c0dde85f0b0bd080818c3c34616e990da2b879c3e3a01d8c56aaf6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe a6b1721d8c0dde85f0b0bd080818c3c34616e990da2b879c3e3a01d8c56aaf6c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/208193/

Comments