MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9a6a44f3eca95cc7785debebea767461798f27978628c58a06474005b8855c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9a6a44f3eca95cc7785debebea767461798f27978628c58a06474005b8855c8
SHA3-384 hash: bf7a4840ac48fd513ae09882153e05690b54f4248bddb986f4ad18eb2a2dca0ad62234d3ec3ef0392623cd746c60ca04
SHA1 hash: fde785abcb4a9938adc69179dcb8d34c087c6e31
MD5 hash: 0a349adaa372da48f43ef9e64330645b
humanhash: floor-oxygen-skylark-zebra
File name:Quotation.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:744'960 bytes
First seen:2020-11-05 09:35:50 UTC
Last seen:2020-11-05 11:52:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:+YVBZJm/bT4gpQHdAqkbmrKuQrFkiVais5DFPv082u2QwQW8/1vtrZH+SZ6m:nUPTQHCqkbmrKReVieFPMNzQW8/fBY
Threatray 2'832 similar samples on MalwareBazaar
TLSH 64F4019267D8FB9CD57F3B315B7256A80B67FD91283DC65F086CF44D09B2A08CA10BA1
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: bjcs01.serverproof.net
Sending IP: 180.76.192.144
From: account-sh@fhtextile.com
Subject: Re: inquiry
Attachment: Quotation.img (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83165/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.35082103.30516.6367.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/521199
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 309697 Sample: Quotation.exe Startdate: 05/11/2020 Architecture: WINDOWS Score: 100 35 www.nedukelspenn.com 2->35 37 nedukelspenn.com 2->37 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 8 other signatures 2->51 11 Quotation.exe 3 2->11         started        signatures3 process4 file5 33 C:\Users\user\AppData\...\Quotation.exe.log, ASCII 11->33 dropped 61 Tries to detect virtualization through RDTSC time measurements 11->61 63 Injects a PE file into a foreign processes 11->63 65 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 11->65 15 Quotation.exe 11->15         started        18 Quotation.exe 11->18         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 15->67 69 Maps a DLL or memory area into another process 15->69 71 Sample uses process hollowing technique 15->71 73 Queues an APC in another process (thread injection) 15->73 20 explorer.exe 15->20 injected process9 dnsIp10 39 trikade.com 50.116.112.232, 49747, 80 UNIFIEDLAYER-AS-1US United States 20->39 41 shops.myshopify.com 23.227.38.64, 49752, 80 CLOUDFLARENETUS Canada 20->41 43 3 other IPs or domains 20->43 53 System process connects to network (likely due to code injection or exploit) 20->53 24 WWAHost.exe 20->24         started        27 autofmt.exe 20->27         started        signatures11 process12 signatures13 55 Modifies the context of a thread in another process (thread injection) 24->55 57 Maps a DLL or memory area into another process 24->57 59 Tries to detect virtualization through RDTSC time measurements 24->59 29 cmd.exe 1 24->29         started        process14 process15 31 conhost.exe 29->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9a6a44f3eca95cc7785debebea767461798f27978628c58a06474005b8855c8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 03:27:11 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vgtkitz6zkk4y54f327l5j3hiylzr4tzpbriywfamr2aaw4ikxea._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2829f8bf819c13d753f3c6b33726df8c46a533f3040b550a86ca0ab34f967e92
Formbook
45cf51569314dac91762e5c1f112c4a640595239d553729f10613f9f59403e84
Formbook
5d23faa05258eb51b196fee00263dc5e4556a37301d312563843a7ac8494ee19
Formbook
74ee80ac61ce369a23feac3296a825873aa257282d5dd0f9c35c385e3d6766cf
Formbook
7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659
Formbook
8df5752017d7f083ddad62b8423ea7109c830dbcdca3fff0ee7aee8d149fdeda
Formbook
911fec402f3bb42d731c4e177c322c0df8d79f680e5a18f538a3ff2e3086c2bf
Formbook
9be9720b02fb636479bbf10a2c3e020c7505ceb058821a644d641d8dd6667785
Formbook
bea5a2a0bade8802b63d59a653b7140792acdfa1fd3f92ccafe9bb592a94882d
Formbook
d98beb65dff0d8e1963f1cc7df755e273bbe45c8143b556bc9a84bcfd0cdea78
Formbook
+ 2'822 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201105-d9zwsghqle/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.progressaofinanceira.com/di4r/
Unpacked files
SH256 hash:
a9a6a44f3eca95cc7785debebea767461798f27978628c58a06474005b8855c8
MD5 hash:
0a349adaa372da48f43ef9e64330645b
SHA1 hash:
fde785abcb4a9938adc69179dcb8d34c087c6e31
Link:
https://www.unpac.me/results/f08cf9c7-938e-4c3e-a92c-7a17bde8bb11/
SH256 hash:
55b1abac5bf3c054c1903bae53dc12578c86f530e039f4507a3a6cc729c98a4e
MD5 hash:
eecf805efff8677aadfdd8bc7964d9ff
SHA1 hash:
53eca536b4b30464848c2ea14a60075cc4bcfb1d
Link:
https://www.unpac.me/results/f08cf9c7-938e-4c3e-a92c-7a17bde8bb11/
SH256 hash:
83876405e589d041050180b7ea64d9456fca09107119e970ca2f30f90d80db74
MD5 hash:
05471ba76e533a95ed7b3120eee00e29
SHA1 hash:
c043a46088cd03f3c0aea04d533041f8489b6f3d
Link:
https://www.unpac.me/results/f08cf9c7-938e-4c3e-a92c-7a17bde8bb11/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/f08cf9c7-938e-4c3e-a92c-7a17bde8bb11/
SH256 hash:
290a2a2881ff015d555649d59c2ddeebe3b9536eb8ed06f09f185990edda31b4
MD5 hash:
bc4c20d803c773fbd897ddcc34d8175f
SHA1 hash:
78d279a93dbf815b30b15f7e0cd223e659c259c3
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/f08cf9c7-938e-4c3e-a92c-7a17bde8bb11/
Parent samples :
7a990daaeb236dac7f6245626e92a4624c798b89e96d573abfd78d2b546af659
74ee80ac61ce369a23feac3296a825873aa257282d5dd0f9c35c385e3d6766cf
a9a6a44f3eca95cc7785debebea767461798f27978628c58a06474005b8855c8
366d589602fe9abe8051f7b13322aaa0efc3d65638575bc6488a65ce75773488
e193e31155334803c7114e1f578689e26cda3faf7539fdb15d19f2f60e8379c1
bd53fc041a6e364f163c70e2bcf38a1565f3764a31b8c94de466fce780f9ab71
496312b0f2439d09765eb76ce146369b9417f59225f86c9b5f0ef8e1bb880602
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 1c88c1c408acb9f504bbf2556fdd5a48b96d0ce2526a8f803a4f9ee08cdec6e1

Formbook

Executable exe a9a6a44f3eca95cc7785debebea767461798f27978628c58a06474005b8855c8

(this sample)

  
Dropped by
MD5 21112c7e1e1491e1a361ab9ea0f24b5c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/83165/
  
Dropped by
SHA256 1c88c1c408acb9f504bbf2556fdd5a48b96d0ce2526a8f803a4f9ee08cdec6e1

Comments