MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa4fad19caeb7d4d9abd68155eee268619442c6cfc8a69c2bc337dd4efdf4b4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa4fad19caeb7d4d9abd68155eee268619442c6cfc8a69c2bc337dd4efdf4b4d
SHA3-384 hash: 1964b85eaad2075fe9be2eec869abb02a681047cd63c9060a1544a7af1c2a00348757d3246da51e8cc34d4b298272672
SHA1 hash: d61b35ba4e797cb6568d798bbb59222120f8f33e
MD5 hash: 099eb059723bc3e0b11cd0483240e7a8
humanhash: equal-florida-saturn-bacon
File name:orden de compra.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:433'664 bytes
First seen:2020-08-05 15:17:40 UTC
Last seen:2020-08-05 16:11:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:NP3SzEM+MzRiGtpV/lNvxjSp0LOr3lFDtgrpiA:lM+MzRiGtpV/lhJLIDSQA
Threatray 5'171 similar samples on MalwareBazaar
TLSH 1694E00437AD9B76D9FC9BF0409D348003B83D67EE62F3A45E8270F626B67508661B97
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server107.neubox.net
Sending IP: 174.136.28.112
From: Arturo Gomez Sánchez <proveedores@promedic.com.mx>
Subject: Re: Re: Pedido de cotizacion
Attachment: orden de compra.zip (contains "orden de compra.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39753/
Detection(s):
SecuriteInfo.com.FileRepMalware.26843.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/411496
Signature
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 258065 Sample: orden de compra.exe Startdate: 05/08/2020 Architecture: WINDOWS Score: 100 43 Malicious sample detected (through community Yara rule) 2->43 45 Sigma detected: Scheduled temp file as task from temp location 2->45 47 Yara detected AntiVM_3 2->47 49 6 other signatures 2->49 10 orden de compra.exe 7 2->10         started        process3 file4 31 C:\Users\user\AppData\Roaming\xconClO.exe, PE32 10->31 dropped 33 C:\Users\user\...\xconClO.exe:Zone.Identifier, ASCII 10->33 dropped 35 C:\Users\user\AppData\Local\...\tmpCEAC.tmp, XML 10->35 dropped 37 C:\Users\user\...\orden de compra.exe.log, ASCII 10->37 dropped 57 Writes to foreign memory regions 10->57 59 Injects a PE file into a foreign processes 10->59 14 RegSvcs.exe 10->14         started        17 schtasks.exe 1 10->17         started        signatures5 process6 signatures7 61 Modifies the context of a thread in another process (thread injection) 14->61 63 Maps a DLL or memory area into another process 14->63 65 Sample uses process hollowing technique 14->65 67 2 other signatures 14->67 19 explorer.exe 14->19 injected 22 conhost.exe 17->22         started        process8 dnsIp9 39 www.yuwanqingmy.com 19->39 41 www.upbeatnewyork.com 19->41 24 explorer.exe 19->24         started        process10 signatures11 51 Modifies the context of a thread in another process (thread injection) 24->51 53 Maps a DLL or memory area into another process 24->53 55 Tries to detect virtualization through RDTSC time measurements 24->55 27 cmd.exe 1 24->27         started        process12 process13 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/aa4fad19caeb7d4d9abd68155eee268619442c6cfc8a69c2bc337dd4efdf4b4d/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 15:19:05 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjh22gok5n6u3gv5nakv53rgqymuildm7sfgtqv4gn65j367jngq._file
Verdict:
malicious
Similar samples:
076ff4f8a53779fff8c12e4447c1f57a7ef651768a84da9d87d9cce62ef30407
FormBook
1c19bcd64c39ebeb4cee087e27d049e032b7c26999edac7fc45372d5717d262c
FormBook
22a420112c97f94c87b2efa2e1d3b46d6f91655c1a86a6b6a1cd94e3e43259af
FormBook
2303d08c9c8f35e63306c76d1c12aa08f963082214151638bf9d2390b43c14d3
FormBook
25b54e1822e3aa47ef8a94b6e326dda299d42081681d03eb514fa661a005d1db
FormBook
5c6d005bb7bd065341b432bf6a27117c76115e18ae10fd21906759d05d05f733
FormBook
77bbe59685fd4ba30b0f14c6471ba479adbe790de6499c7ea2370b2055fcc9c3
FormBook
7aea54e5a7af3c0486ca05606e29416b4bae058d6ca16e06afe2d57a9da90838
FormBook
968bef9303261890912cbde7737195a73c2d8892457c3cc8a327008effb4e8c9
FormBook
a41851a6ade9f88136829a392e1ac11e0e06c21a25fdd0e3961a347d28204608
FormBook
+ 5'161 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook evasion persistence
Link:
https://tria.ge/reports/200805-ntyxhe8y5n/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of SendNotifyMessage
System policy modification
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/aa4fad19caeb7d4d9abd68155eee268619442c6cfc8a69c2bc337dd4efdf4b4d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 236c1f89670b6e65ebe496d838b3e68cd6100570994de9dcd4ea32dd3eead793

FormBook

Executable exe aa4fad19caeb7d4d9abd68155eee268619442c6cfc8a69c2bc337dd4efdf4b4d

(this sample)

  
Dropped by
MD5 77ed3c85577d2e713a789f43c57b9328
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/39753/
  
Dropped by
SHA256 236c1f89670b6e65ebe496d838b3e68cd6100570994de9dcd4ea32dd3eead793

Comments