MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab8c3b31b7abfcd76554ac8640d5781860ba99d878fb128ed313c64eeef6e39d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab8c3b31b7abfcd76554ac8640d5781860ba99d878fb128ed313c64eeef6e39d
SHA3-384 hash: 46d073a1f0402a033517cce822db8b989911494ce495672bd522090e1c09c238b8b6794857e57876e3ac60e672bc4c5a
SHA1 hash: e9a868266976c2be2223dd5eb83d6e4c9a47a4cc
MD5 hash: 65081e9a5f850cb7f78ea98f4dbbb869
humanhash: bravo-video-mars-cup
File name:SwiftTB02811.Scan.pdf..exe
Download: download sample
Signature Formbook
Create hunting rule
File size:734'720 bytes
First seen:2020-10-09 10:42:02 UTC
Last seen:2020-10-09 13:15:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:DiTXF69t+R3pUYmuIav4P7kYCQSZp6xwVPY0np+uId3aTfyEFTOZZmVay+Sds7:DiTVok3pUYmuL4DrCJ6xB0pWaTfyEAZQ
Threatray 2'380 similar samples on MalwareBazaar
TLSH 74F4018633E973CDE4A77A714F740D68A632FC664337826E8817D44E496DA82CB513B3
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69527/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/486634
Signature
Detected unpacking (changes PE section rights)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 295760 Sample: SwiftTB02811.Scan.pdf..exe Startdate: 09/10/2020 Architecture: WINDOWS Score: 100 33 www.1005cy.com 2->33 35 2ayhweb.xaomenlebo001.com 2->35 37 2ayhback.javalebogame001.com 2->37 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected AntiVM_3 2->49 51 7 other signatures 2->51 10 SwiftTB02811.Scan.pdf..exe 3 2->10         started        signatures3 process4 file5 31 C:\Users\...\SwiftTB02811.Scan.pdf..exe.log, ASCII 10->31 dropped 61 Detected unpacking (changes PE section rights) 10->61 63 Tries to detect virtualization through RDTSC time measurements 10->63 65 Injects a PE file into a foreign processes 10->65 14 SwiftTB02811.Scan.pdf..exe 10->14         started        17 SwiftTB02811.Scan.pdf..exe 10->17         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 14->67 69 Maps a DLL or memory area into another process 14->69 71 Sample uses process hollowing technique 14->71 73 Queues an APC in another process (thread injection) 14->73 19 help.exe 14->19         started        22 explorer.exe 14->22 injected process9 dnsIp10 53 Modifies the context of a thread in another process (thread injection) 19->53 55 Maps a DLL or memory area into another process 19->55 57 Tries to detect virtualization through RDTSC time measurements 19->57 25 cmd.exe 1 19->25         started        39 www.shuttandco.com 192.187.111.222, 49758, 80 NOCIXUS United States 22->39 41 fo07.ddns.net 111.251.166.3, 49757, 80 HINETDataCommunicationBusinessGroupTW Taiwan; Republic of China (ROC) 22->41 43 4 other IPs or domains 22->43 59 System process connects to network (likely due to code injection or exploit) 22->59 27 autochk.exe 22->27         started        signatures11 process12 process13 29 conhost.exe 25->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab8c3b31b7abfcd76554ac8640d5781860ba99d878fb128ed313c64eeef6e39d/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 10:10:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vogdwmnxvp6nozkuvsdebvlydbqlvgoypd5rfdwtcpde53xw4ooq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
07528f3c583c546d2b444b091c3ede380c6427ed0691b95294c7e32dd35560ab
Formbook
4ba0d07d32c048141100317f95bd6dd8b791ba9c6608730b8408530490a13922
Formbook
5abc963a4cbaaee6582d5db264da8b2cb0c5a760115047a8df1e629c48dfc6e9
Formbook
80a9f4ef9f226558954221ab49e2df9557a030d87946368bfb51e7440bd58d8b
Formbook
816581131b3f726da0cfef239111730e74f04e9015df6a519b92a7e0d6e2cd6a
Formbook
c61d5fa6c2a4f421767a7c793da96a0e8e88d482e078ef994f0a50bac73464f0
Formbook
d4014ac2689b47f11708425cad3d8aa02dd05ee6d6745006156dffbe0a27b4be
Formbook
da111408d9dccb99b2c429d535ca55f6e970d911da4c24553e75d02fe9c00489
Formbook
ec4ee2fa916e9fc280f06af0ceded7835693723ebbc6c60bd6e371b5d4ad006a
Formbook
fc0d990ef758b78feb650b93c761b3f0fe5daa30d1fbcc77a424eac49ca8cc4d
Formbook
+ 2'370 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201009-7zk59gg23a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.darkatnightgame.com/fgn/
Unpacked files
SH256 hash:
ab8c3b31b7abfcd76554ac8640d5781860ba99d878fb128ed313c64eeef6e39d
MD5 hash:
65081e9a5f850cb7f78ea98f4dbbb869
SHA1 hash:
e9a868266976c2be2223dd5eb83d6e4c9a47a4cc
Link:
https://www.unpac.me/results/3d893cf4-6a5c-4e6d-a3c1-791d48ad554b/
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/3d893cf4-6a5c-4e6d-a3c1-791d48ad554b/
SH256 hash:
fb2eb4ceadc2f6fb8dbeef9e52b4db6986ae52b11497ee1f929d84da4f5a70c9
MD5 hash:
b24aa405325e2b5e267386e22a357e44
SHA1 hash:
5b9a63d933ab77210c6823981c2b2369fc8de31c
Link:
https://www.unpac.me/results/3d893cf4-6a5c-4e6d-a3c1-791d48ad554b/
SH256 hash:
de125fccc2768c52263a589defb746f101e07fc7279fe3f31f1961a92b282058
MD5 hash:
590eb3c217a7025aaa45696cdadc52e8
SHA1 hash:
6f82b1e68cef36c28311f6fe7b9c90fa679a7feb
Link:
https://www.unpac.me/results/3d893cf4-6a5c-4e6d-a3c1-791d48ad554b/
SH256 hash:
ea40b4c489ae8a15845588abdfc86ac773e0fd414f8776a47c247a075d14ee04
MD5 hash:
ede37755372a928134c272aaff0d5773
SHA1 hash:
bb20b39a34e4a4d63d31c39cc158f0c9b1fdf5eb
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/3d893cf4-6a5c-4e6d-a3c1-791d48ad554b/
Parent samples :
f9b5791e5556abf20bf540734de904ea4a0508005071f43531a1347f7fdcce08
fc0d990ef758b78feb650b93c761b3f0fe5daa30d1fbcc77a424eac49ca8cc4d
c61d5fa6c2a4f421767a7c793da96a0e8e88d482e078ef994f0a50bac73464f0
ab8c3b31b7abfcd76554ac8640d5781860ba99d878fb128ed313c64eeef6e39d
4ffeba70e305d0d745d9a60fb8a78cc3f161c3fe4a7373c2303be8f095426abd
cc0807a29f920ca94099399975ae3d52b741d6f1387ea3fb26c44b1bc22cd95c
aa7140aa9e404fcab5e45ba552de89669da4446c6a3474f307def1a75a3d37e0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ab8c3b31b7abfcd76554ac8640d5781860ba99d878fb128ed313c64eeef6e39d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe ab8c3b31b7abfcd76554ac8640d5781860ba99d878fb128ed313c64eeef6e39d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/69527/

Comments