MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b07a33b6e6d8007b04f1f4a78cd8be773506bbf6b60ed0227665188d57e82a15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b07a33b6e6d8007b04f1f4a78cd8be773506bbf6b60ed0227665188d57e82a15
SHA3-384 hash: c35234d5ade5ebfc539b77faaca7e073bceab1264699261f6b4827185d3ecadb081ee77b78215a707123d086dc0a6da0
SHA1 hash: 5bb236d5c49991298040dd88b4b83c4cb21e148a
MD5 hash: 1e46a61b2d491a15952bd579210ecb8f
humanhash: artist-eight-don-apart
File name:moni $@.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:680'960 bytes
First seen:2021-08-03 13:15:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:YBg2LBBBBBBBBBBBXBBBBBBBBBBBRqLHPmm9SrzQnD+rdhpAUh7qIe6YHedKhBg/:YZmvmYSwSpFZi+dKbgwtGJl+KP3hv
Threatray 132 similar samples on MalwareBazaar
TLSH T178E402BFA341AF67E97C24F5A072295042FA414D6102E76AFDD460FCE5E23C527206EB
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
moni $@.exe
Verdict:
Malicious activity
Analysis date:
2021-08-03 13:17:32 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/23b45b87-992c-4c64-bad0-264104807f4b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176059/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8803f978-1696-4107-bbc8-a6a8698d227c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/826262
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Process Start Without DLL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 458678 Sample: moni $@.exe Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 19 Multi AV Scanner detection for domain / URL 2->19 21 Found malware configuration 2->21 23 Malicious sample detected (through community Yara rule) 2->23 25 10 other signatures 2->25 6 moni $@.exe 3 2->6         started        process3 file4 17 C:\Users\user\AppData\...\moni $@.exe.log, ASCII 6->17 dropped 9 RegSvcs.exe 6->9         started        11 RegSvcs.exe 6->11         started        13 RegSvcs.exe 6->13         started        15 2 other processes 6->15 process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b07a33b6e6d8007b04f1f4a78cd8be773506bbf6b60ed0227665188d57e82a15/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 02:54:57 UTC
AV detection:
18 of 27 (66.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wb5dhnxg3aahwbhr6styzwf6o42qno7wwyhnaitwmumi2v7ifikq._file
Verdict:
unknown
Similar samples:
28cc568c37149f18926f2b7127ec063e82441adf22c28a55486c3198476f55a8
Formbook
3cb221973d52d12fc900f37496a9c5f77b30da63886a0f7d54111982c00e872b
Formbook
5e2255d59560c85c4a6c30ffa54e00b2805b584292de464befaf01a614539229
Formbook
60869d9c3d3b8f30089a849750b4e721fbc3501136727442382f327c07c60f5f
Formbook
74cfbafcf2fd96542b5d4221f9fc839c53c84be9bdcd533663d4b512a22ae720
Formbook
78b89b05c3beb9d8275a36c785e9f629241c37768d3eca480ad18cd61cee01a3
Formbook
9a046a2f73df3a0bd2880b04fa658d3cf278edd40c6fca7f9dbde5342510d085
Formbook
b58a776cf07315618ecd00ac91fec52b5835e3af3cb743642df97ce0c95e69b4
Formbook
da2c90083bd3bf27f6bb3bd87a23fb71dabbb12305e5a190afc6e3cc3344c32b
Formbook
ef493fe2688db7c97fd7e0af12bae0b42aeee9c1c7ccf241865e1cfa5cb50cac
Formbook
+ 122 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210803-15kymcrh6j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
6f54cee217deaf54bd3f9c1a2169f437a7eee29309f87232ce46032eca3b1363
MD5 hash:
550970889e4325645c8671d69bf96a91
SHA1 hash:
35673655771636cd80db6fcc2714bee15d6156b1
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/27b6846c-b341-47e6-8bc6-8a118bda407f/
Parent samples :
4cf933c9f31b4e3dae8002043c64a401f91a228adeadfbca9b172b3333f1be6b
2d7aac32ea8a8329262ead70ec2f030c1a4061e4edafdf03e605bb9ce606836e
3a4677dc6f14f38983af15458b11d5f92e71dea8d5cd0e5b263c50d211a72621
e59a1d022c6c4f0cc7d23689004e65ea7f1f940adef98cf891a008dd9d7f66d9
06e6b50f2a956f1fff285d4717f7dc33af56f8f08255f744cbd0eba9b0fe82e9
38e4be0b1612a87858ee40b6c9eebd264d02e4488a34c3f1269ca385b01d1b20
ec5f4dcc08f293334a46654b279444c6c128608c6af38a4139a5b28503954219
6c60876d91087cbd176ff5419577f2b3315b2d3a9d9c6d11a06b95ea10d5311f
b07a33b6e6d8007b04f1f4a78cd8be773506bbf6b60ed0227665188d57e82a15
77d33d0e8b91781213a971ebc2e6abe4191bf2c28ff0ede19b07db092f590dff
06d062adc4478b2c95f98fec038fe559eff9fa60ce98d05d257f37c00a9026d6
4ca6a48021d7d442d9311b158691b1f219576d7d37a99f64741463659903ad4c
SH256 hash:
007470569b63f836f90868dc76a62f4370d5a63779b90026bfb1c0c974a0f672
MD5 hash:
e0449f72eeff3a1d670e345a4e9dcda4
SHA1 hash:
688bda1d09f477d2d785437a8f4b690bceee8a7b
Link:
https://www.unpac.me/results/27b6846c-b341-47e6-8bc6-8a118bda407f/
SH256 hash:
cfef97ff706312dff4edd998aeee22f1283221631ebb0cc954bebbb701c1465c
MD5 hash:
a0f625a3d3348903f3c902f588c0e4f5
SHA1 hash:
20d1f0b74abe6f500e8c21119f55281926210ac0
Link:
https://www.unpac.me/results/27b6846c-b341-47e6-8bc6-8a118bda407f/
SH256 hash:
b07a33b6e6d8007b04f1f4a78cd8be773506bbf6b60ed0227665188d57e82a15
MD5 hash:
1e46a61b2d491a15952bd579210ecb8f
SHA1 hash:
5bb236d5c49991298040dd88b4b83c4cb21e148a
Link:
https://www.unpac.me/results/27b6846c-b341-47e6-8bc6-8a118bda407f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/b07a33b6e6d8007b04f1f4a78cd8be773506bbf6b60ed0227665188d57e82a15

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe b07a33b6e6d8007b04f1f4a78cd8be773506bbf6b60ed0227665188d57e82a15

(this sample)

  
Dropped by
null
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/176059/

Comments