MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2d26e59b2f971fc8dad4d1e077a62abaa7fa3650f52d55a6b9974e151a5cde4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2d26e59b2f971fc8dad4d1e077a62abaa7fa3650f52d55a6b9974e151a5cde4
SHA3-384 hash: 49ede88d68c76e131b8fc7dd294f45a6f23c709534a44753c6299837ca56624491330701841c8f1ed050584517ef757a
SHA1 hash: d4be3b8b4caa60f2051042fe296b2257d7b15a1f
MD5 hash: f0a49867673421041ed8c5959ead26b8
humanhash: monkey-sink-september-robert
File name:Scan copy 24032021_jpeg.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:943'616 bytes
First seen:2021-03-24 13:35:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ibJXVFudChnbwGd4ckXwH6emQHv72VMQHQchH1Xv4SvoZ:SJXydUn0bvXUHHvK91QCC
Threatray 4'316 similar samples on MalwareBazaar
TLSH AB15E68C5D9EC2C7D6354BA882CEC4E946EA5FF34F22D8BAB9C847CBC120745F506526
Reporter malwarelabnet
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Scan copy 24032021_jpeg.exe
Verdict:
Malicious activity
Analysis date:
2021-03-24 13:53:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1d395a19-8723-4af8-b5d6-2b1b5e83a455

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET-5.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/652264
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses netstat to query active network connections and open ports
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 375083 Sample: Scan copy 24032021_jpeg.exe Startdate: 24/03/2021 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 10 other signatures 2->45 10 Scan copy 24032021_jpeg.exe 3 2->10         started        process3 file4 27 C:\Users\...\Scan copy 24032021_jpeg.exe.log, ASCII 10->27 dropped 13 Scan copy 24032021_jpeg.exe 10->13         started        process5 signatures6 53 Modifies the context of a thread in another process (thread injection) 13->53 55 Maps a DLL or memory area into another process 13->55 57 Queues an APC in another process (thread injection) 13->57 16 explorer.exe 9 13->16 injected process7 dnsIp8 29 appleshopsenegal.com 207.174.215.190, 49721, 80 PUBLIC-DOMAIN-REGISTRYUS United States 16->29 31 www.mro-pt.com 16->31 33 5 other IPs or domains 16->33 35 System process connects to network (likely due to code injection or exploit) 16->35 37 Uses netstat to query active network connections and open ports 16->37 20 NETSTAT.EXE 16->20         started        signatures9 process10 signatures11 47 Modifies the context of a thread in another process (thread injection) 20->47 49 Maps a DLL or memory area into another process 20->49 51 Tries to detect virtualization through RDTSC time measurements 20->51 23 cmd.exe 1 20->23         started        process12 process13 25 conhost.exe 23->25         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b2d26e59b2f971fc8dad4d1e077a62abaa7fa3650f52d55a6b9974e151a5cde4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-24 11:27:04 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wljg4wns7fy7zdnnjupao6tcvovh7i3fb5jnkwtltf2ocunfzxsa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
06fa1b160e322bd7710c9110b1e4e873795b5c2680b8bbe70bbaf23484533459
Formbook
0953e54968ca9407a172c0a35a00d8b30ec603770809bbd2901a070e1b83b7f8
Formbook
298b7204317915aa463fecd43ee99abbb9020e993dc0ffdcc5e382d0f590a7b8
Formbook
6c131f342e8226706ba1b39cc955852b022130c14ea12bd3b3cf340bbea25bf6
Formbook
7c201535a28746b62adfa831cfccac096903f5b17ee83b8364fc890fa70a59fd
Formbook
92f656d44d38fbc5e7964e36634bf95d18e157228624d1b38ea933633579ddc4
Formbook
988d84650b91424e291cb84ef84433cbd4214622365b226d925d71ffda0bccb8
Formbook
9dac57302e2261a1a3c6a665d3960525b27fb70a1fd6b1e135a3e72f11c6f3e6
Formbook
dd4d1da7c146e47e25b601cba1d6f324eace694055d43e1c67288df6a0ea1951
Formbook
f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
Formbook
+ 4'306 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210324-ekea49wdn2/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.fessuseyyesseee.com/mdi/
Unpacked files
SH256 hash:
c22b9993fd6abea236edcc1bf476bcd4a09015b4af09eedf660a43bf3d29a16f
MD5 hash:
1d1234ba19c430923b22f531bb19b369
SHA1 hash:
9868c1e97a3be16100a61b5ee1f7d2838b4782a8
Link:
https://www.unpac.me/results/69cd10a6-c37b-4c11-9f5c-2f4f1194c17b/
SH256 hash:
b2d26e59b2f971fc8dad4d1e077a62abaa7fa3650f52d55a6b9974e151a5cde4
MD5 hash:
f0a49867673421041ed8c5959ead26b8
SHA1 hash:
d4be3b8b4caa60f2051042fe296b2257d7b15a1f
Link:
https://www.unpac.me/results/69cd10a6-c37b-4c11-9f5c-2f4f1194c17b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/b2d26e59b2f971fc8dad4d1e077a62abaa7fa3650f52d55a6b9974e151a5cde4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments