MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445
SHA3-384 hash: f3a302b4d5efa5da7d5fdeb3a1197e64cac46a93c495a49f17f01ccbbd660792a573eea14382ab3657ed73ba7d8dc3b0
SHA1 hash: 88efdffd6819d63ac4cca898b13ab3c01553ed26
MD5 hash: cd4c0048444fce1f2199415a474fdba8
humanhash: west-nitrogen-colorado-sodium
File name:booking payments.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'064'512 bytes
First seen:2020-08-19 12:41:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:BAOcZeJM26Lj+7Ok9F8oZKzI2T0Gxg539FQZMaBQiOzl:b85j+7NDZKzhnxw96ZMAa
Threatray 2'435 similar samples on MalwareBazaar
TLSH 81351202B6D1C872D47319335A2A7B21AD397D301F39EA2EB3E0497DEA751D05621BF2
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: franceloc-postfix.filnet.fr
Sending IP: 194.187.193.119
From: Cláudia Diniz <info@wip-hausschutz.de>
Reply-To: finance.booking.com@outlook.com
Subject: GROUP CONFIRMATION
Attachment: booking payments.rar (contains "booking payments.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/48509/
Detection(s):
SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Sending a UDP request
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file
Creating a file in the %temp% directory
Adding an access-denied ACE
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Forced shutdown of a system process
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/437970
Signature
Allocates memory in foreign processes
Drops PE files with a suspicious file extension
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspicious Svchost Process
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 271476 Sample: booking payments.exe Startdate: 20/08/2020 Architecture: WINDOWS Score: 100 53 www.fex-tracks.com 2->53 57 Malicious sample detected (through community Yara rule) 2->57 59 Yara detected FormBook 2->59 61 Yara detected AntiVM autoit script 2->61 63 6 other signatures 2->63 14 booking payments.exe 10 2->14         started        signatures3 process4 file5 49 C:\Users\user\AppData\...\ertoefqsph.pif, PE32 14->49 dropped 17 ertoefqsph.pif 3 3 14->17         started        process6 signatures7 55 Machine Learning detection for dropped file 17->55 20 wscript.exe 1 17->20         started        process8 process9 22 ertoefqsph.pif 1 20->22         started        file10 47 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 22->47 dropped 71 Writes to foreign memory regions 22->71 73 Allocates memory in foreign processes 22->73 75 Sample uses process hollowing technique 22->75 77 Injects a PE file into a foreign processes 22->77 26 RegSvcs.exe 22->26         started        29 RegSvcs.exe 22->29         started        31 wscript.exe 1 22->31         started        signatures11 process12 signatures13 79 Modifies the context of a thread in another process (thread injection) 26->79 81 Maps a DLL or memory area into another process 26->81 83 Sample uses process hollowing technique 26->83 33 explorer.exe 26->33 injected 85 Tries to detect virtualization through RDTSC time measurements 29->85 87 Queues an APC in another process (thread injection) 29->87 36 ertoefqsph.pif 31->36         started        process14 dnsIp15 51 www.enthb.com 33->51 38 svchost.exe 33->38         started        41 ipconfig.exe 33->41         started        process16 signatures17 65 Modifies the context of a thread in another process (thread injection) 38->65 67 Maps a DLL or memory area into another process 38->67 69 Tries to detect virtualization through RDTSC time measurements 38->69 43 cmd.exe 1 38->43         started        process18 process19 45 conhost.exe 43->45         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 08:04:50 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vfb7yraiyl2z6lpqv6v7ha3ollnoskupjjfr3ibhbyyt3dvhqrcq._file
Verdict:
malicious
Similar samples:
1678611ad4996f718c0a8998ce194dfe117bf47529c4ccad51a6816ecf4f1bb4
Formbook
37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61
Formbook
5c5e4e31bde29168e03fa8cce36bab9b577568137edab59f68f8968616546ed9
Formbook
62a7f441ba21aaa568fe700029fa32d6dd7eeb2ed0a7f7259a680f2aae65ee31
Formbook
9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
Formbook
b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c
Formbook
c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa
Formbook
cbf010e4d58f12ac1a0ce0ef5e29636c13a3a6ee5b052aae7cad7e9a95448276
Formbook
d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa
Formbook
f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510
Formbook
+ 2'425 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat persistence spyware trojan stealer family:formbook
Link:
https://tria.ge/reports/200819-g68sr65dv6/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Adds policy Run key to start application
Executes dropped EXE
Formbook Payload
Formbook
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://www.fex-tracks.com/hx232/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a6aba1dab525bd8e49e3651ec91562d9ff90c13ac631faade0e521a82a327e80

Formbook

Executable exe a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445

(this sample)

  
Dropped by
MD5 8f3aca9bda3cb2b6155b8cd275c77063
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/48509/
  
Dropped by
SHA256 a6aba1dab525bd8e49e3651ec91562d9ff90c13ac631faade0e521a82a327e80

Comments