MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac4d58dc0ca5617911f7ff52953cec2eac9249963dbce3b2f682aeb6eb1baa77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac4d58dc0ca5617911f7ff52953cec2eac9249963dbce3b2f682aeb6eb1baa77
SHA3-384 hash: 1ddea0e61f2b38241168d2df79842c465409898661a8e5d19652363c33aa3414102519733ded098167039e7a3ac10ed0
SHA1 hash: 4a4dbf63547a72239d5fc7006d137b9d27eaf0bf
MD5 hash: 48520b30c57caafbf360c5e71920b82a
humanhash: steak-cardinal-delaware-failed
File name:uzo.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:551'424 bytes
First seen:2020-10-22 10:30:46 UTC
Last seen:2020-10-22 14:01:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:D35JaROZzRwQRyL4TdE+dpW3Lduypw90m2pr:DXl2L4JkgywIr
Threatray 2'630 similar samples on MalwareBazaar
TLSH E6C4E0617298EF55E17EAB3D50A711201BF1F511D32AE68AFFD840DC1962F8847BAB03
Reporter JoulK
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74621/
Detection(s):
SecuriteInfo.com.ArtemisTrojan.19448.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Launching cmd.exe command interpreter
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/507001
Signature
.NET source code contains potential unpacker
Binary contains a suspicious time stamp
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses netstat to query active network connections and open ports
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 302623 Sample: uzo.exe Startdate: 22/10/2020 Architecture: WINDOWS Score: 100 34 Malicious sample detected (through community Yara rule) 2->34 36 Yara detected AntiVM_3 2->36 38 Yara detected FormBook 2->38 40 5 other signatures 2->40 10 uzo.exe 3 2->10         started        process3 process4 12 RegSvcs.exe 10->12         started        15 RegSvcs.exe 10->15         started        signatures5 50 Modifies the context of a thread in another process (thread injection) 12->50 52 Maps a DLL or memory area into another process 12->52 54 Sample uses process hollowing technique 12->54 56 Queues an APC in another process (thread injection) 12->56 17 explorer.exe 12->17 injected 58 Tries to detect virtualization through RDTSC time measurements 15->58 process6 dnsIp7 28 www.crown-friendly.info 150.95.255.38, 49741, 80 INTERQGMOInternetIncJP Japan 17->28 30 www.zambezia-promo.info 17->30 32 3 other IPs or domains 17->32 42 System process connects to network (likely due to code injection or exploit) 17->42 21 NETSTAT.EXE 17->21         started        signatures8 process9 signatures10 44 Modifies the context of a thread in another process (thread injection) 21->44 46 Maps a DLL or memory area into another process 21->46 48 Tries to detect virtualization through RDTSC time measurements 21->48 24 cmd.exe 1 21->24         started        process11 process12 26 conhost.exe 24->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac4d58dc0ca5617911f7ff52953cec2eac9249963dbce3b2f682aeb6eb1baa77/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 10:32:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vrgvrxamuvqxsepx75jjkphmf2wjesmwhw6ohmxwqkxln2y3vj3q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
115e12fb613c8200563e60ee8acd822733772ebac21e27f203a7342043442d8a
Formbook
3f8bef60842d6aa5827f315301d8b8b116a0938ed26f9da7eda3db51c104efb4
Formbook
410b12d131a36c0b5be88c52e6ad02a1e50b20c4d80f30de42ea5a260fc92624
Formbook
805024bdbd61ad0a7a280c42f98c89da5563c2498ed768971ddc74dca126e591
Formbook
82f4ebd30b18743d8cc409de5931a978434755705af9bbfa3c6d8d0b34d30a6b
Formbook
89bf15eae14f60d6acc308cead31f09459947626b9839bbbddbf76f00821fe3b
Formbook
b19d067a87767c377a60981192e5edb9256ce11f7d663cdcae2af3d8d0c0c382
Formbook
bcaf7b4adc919fd5aaae24902b8135e2ad6d13249e9cb784b1532b52e40449b5
Formbook
d8eca36ecff579ceffbd778ab8c8949a94d4967e1c0965988b2a68671f1915ef
Formbook
e6d2c97461c6aac9ea130eaa96f9927b57998c04b5e7573a555caa729178a70c
Formbook
+ 2'620 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201022-kyg7djw2jn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.dagadia.com/pna/
Unpacked files
SH256 hash:
f71ee183e103460d014bf056588411bbd1f6faa4357296c39917cff0d371111c
MD5 hash:
244556b90530fb24381210505a45fc5d
SHA1 hash:
39ab5f3bf10f61405f424904ae8239d8725a6950
Link:
https://www.unpac.me/results/a6c1a1bc-bf4a-409f-bd18-d259ce1d561d/
SH256 hash:
f84b8922021d6ed244bb8a4b9fe791822a35cc41687fb88f32d8d4bd581673a9
MD5 hash:
1faa0439d5d3403f7b06f1c7585fd676
SHA1 hash:
e43a80d68bfef1beb66479822f00a4fe00e0f381
Link:
https://www.unpac.me/results/a6c1a1bc-bf4a-409f-bd18-d259ce1d561d/
SH256 hash:
ac4d58dc0ca5617911f7ff52953cec2eac9249963dbce3b2f682aeb6eb1baa77
MD5 hash:
48520b30c57caafbf360c5e71920b82a
SHA1 hash:
4a4dbf63547a72239d5fc7006d137b9d27eaf0bf
Link:
https://www.unpac.me/results/a6c1a1bc-bf4a-409f-bd18-d259ce1d561d/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/a6c1a1bc-bf4a-409f-bd18-d259ce1d561d/
SH256 hash:
93c5b27938fa31044ae3611e93bbdf457e79af23f4b707608dd7b2c2278bebe6
MD5 hash:
d746ab6b3d5ad16da1c18b37f2dfacff
SHA1 hash:
2780d3ab625248af6cc987bb402a750cddaba217
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/a6c1a1bc-bf4a-409f-bd18-d259ce1d561d/
Parent samples :
e6d2c97461c6aac9ea130eaa96f9927b57998c04b5e7573a555caa729178a70c
ac4d58dc0ca5617911f7ff52953cec2eac9249963dbce3b2f682aeb6eb1baa77
d11ae1d5e09d63aa386479af620faf3b9053d12e6d3a8a1353aba274fef2153e
ded4435057919aa79f8453db4172ffd89198323fa247e70daa418a7a21136df2
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe ac4d58dc0ca5617911f7ff52953cec2eac9249963dbce3b2f682aeb6eb1baa77

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/74621/
  
URLhaus
https://urlhaus.abuse.ch/url/734334/
  
Delivery method
Distributed via web download

Comments