MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f
SHA3-384 hash: 1da4ed586ce89cfb329496d5879f66119ad370c005b9837ef1ccea3b3ca397cdb97df3ca85f05c8dc8a3edc68dc716a8
SHA1 hash: f90d47ed2f471017c913c6e6d5924f38d9a6673c
MD5 hash: 4744495f286ed57aee218fe035b6d8b5
humanhash: rugby-nitrogen-apart-cat
File name:Halkbank,doc 00100210210.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:277'325 bytes
First seen:2021-04-21 09:13:53 UTC
Last seen:2021-04-21 16:10:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ea4e67a31ace1a72683a99b80cf37830 (70 x Formbook, 64 x GuLoader, 54 x Loki)
ssdeep 6144:2YYvlMdJ5hjW/j1t+DCrO2j3DU5/vAjH4EWqJENP:u/5t+DCJj3I5/vAcTP
Threatray 4'750 similar samples on MalwareBazaar
TLSH CC441286B2B4DCB3D7BA473009764B67CB96C225908F21975B503BAAB9712C3FE1F540
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/141960/
Detection(s):
SecuriteInfo.com.Troj.Kryptik-VJ.19162.13467.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Sending a UDP request
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 09:36:36 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wa7wxrpoydzea5vt54whmgzb25oergwtjrpzjxh7vnwswtlfey7q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
5aa64b3eef03b9c837e37102be20cb4f537c524b2a2531bf1bf6dd6a02461d7e
Formbook
6f4fbab85c58d588450bc856ceff3894645e0033b4c4d2684184a8430c01daa4
Formbook
9433390a8374d47e62017b03c8d949af363e1f1aaa5247a2e320fc611c42f138
Formbook
957c5b5a6f0af47354f9ed2d09522fc671b8c0af06e3f3a5b6354e111b2c8129
Formbook
988d84650b91424e291cb84ef84433cbd4214622365b226d925d71ffda0bccb8
Formbook
a01cc1fb91c9f7d7490e45a84b861e7188a0f3d97769710af895ee843a19699c
Formbook
d69345d398849a377103e09925aca369a6ee8fdaca08745d3bbb02aa79eb2861
Formbook
d8e0edf1cca3b6edefcd830e233131c593997b5bd4454891dc1b70614862f718
Formbook
dd44eb26a328f1e86823339666e1b1237ad7b1d880694c1b8fb8164b931aa512
Formbook
f6d5091cd464ce00768476f6b2434d0a11ce48fcdf47441c6ca5ff1f643d696a
Formbook
+ 4'740 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210421-aks7mkksqj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.magnumopuspro.com/nyr/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.57
Link:
https://yomi.yoroi.company/submissions/b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 256ddf8556d759c829d9ebfb85e2ec242b3bf94d38f2cbf9edfb5c780973a256

Formbook

Executable exe b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 256ddf8556d759c829d9ebfb85e2ec242b3bf94d38f2cbf9edfb5c780973a256
Cape
Cape
https://www.capesandbox.com/analysis/141960/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-21 10:24:38 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0032.001] Data Micro-objective::CRC32::Checksum
1) [C0026.002] Data Micro-objective::XOR::Encode Data
4) [C0045] File System Micro-objective::Copy File
5) [C0046] File System Micro-objective::Create Directory
6) [C0048] File System Micro-objective::Delete Directory
7) [C0047] File System Micro-objective::Delete File
8) [C0049] File System Micro-objective::Get File Attributes
9) [C0051] File System Micro-objective::Read File
10) [C0050] File System Micro-objective::Set File Attributes
11) [C0052] File System Micro-objective::Writes File
12) [E1510] Impact::Clipboard Modification
13) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
14) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
15) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
16) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
17) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
18) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
19) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
20) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
21) [C0017] Process Micro-objective::Create Process
22) [C0038] Process Micro-objective::Create Thread
23) [C0018] Process Micro-objective::Terminate Process