MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4aabf02da27e27110077d1d1cc28de4494ee4488750828cc2027c56b60a46d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4aabf02da27e27110077d1d1cc28de4494ee4488750828cc2027c56b60a46d7
SHA3-384 hash: 3bc5e04894c28905a76f582a4b52c7395509bc8746203e4817115e3e303bd181a291c949e57a58ab3e0dc9bc725040e0
SHA1 hash: 8aa7ba899554db9810a785791db59249b29c5030
MD5 hash: 82f0672837cf13136c24555b33fbf619
humanhash: sodium-saturn-king-sink
File name:yeni sipariş.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:579'072 bytes
First seen:2020-10-26 14:35:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:vguEADHGuCL4Q1Nnp2uJnk/QFNwUT+1b3XS/Ex9C:FDHy4Q1Nn8uG/WNwUYWsx
Threatray 2'772 similar samples on MalwareBazaar
TLSH 8BC4E1217388D742E13A97B84021D03067F1BC86DB31D6297EE47BEF25B2F858B69716
Reporter abuse_ch
Tags:exe FormBook geo TUR


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: host2.himbimarket.com
Sending IP: 72.52.244.66
From: Dizayn Makina Muhasebe <engin@demak.com.tr>
Subject: Re: Re: yeni sipariş talebi
Attachment: yeni sipariş.zip (contains "yeni sipariş.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/79185/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Windows subdirectories
Sending a UDP request
Creating a file
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/512003
Signature
.NET source code contains potential unpacker
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 305181 Sample: yeni sipari#U015f.exe Startdate: 26/10/2020 Architecture: WINDOWS Score: 100 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for dropped file 2->43 45 Sigma detected: Scheduled temp file as task from temp location 2->45 47 9 other signatures 2->47 10 yeni sipari#U015f.exe 8 2->10         started        process3 file4 31 C:\Users\user\AppData\...\aBviqBRGynLixC.exe, PE32 10->31 dropped 33 C:\Users\user\AppData\Local\...\tmp2DDD.tmp, XML 10->33 dropped 13 RegSvcs.exe 10->13         started        16 schtasks.exe 1 10->16         started        process5 signatures6 57 Modifies the context of a thread in another process (thread injection) 13->57 59 Maps a DLL or memory area into another process 13->59 61 Sample uses process hollowing technique 13->61 63 2 other signatures 13->63 18 explorer.exe 13->18 injected 22 conhost.exe 16->22         started        process7 dnsIp8 35 hobbyhousekennels.com 192.169.155.85, 49759, 80 GO-DADDY-COM-LLCUS United States 18->35 37 www.kumcal.com 104.24.115.232, 49750, 80 CLOUDFLARENETUS United States 18->37 39 4 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 24 raserver.exe 18->24         started        signatures9 process10 signatures11 51 Modifies the context of a thread in another process (thread injection) 24->51 53 Maps a DLL or memory area into another process 24->53 55 Tries to detect virtualization through RDTSC time measurements 24->55 27 cmd.exe 1 24->27         started        process12 process13 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b4aabf02da27e27110077d1d1cc28de4494ee4488750828cc2027c56b60a46d7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 06:27:51 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wsvl6aw2e7rhceahpuorzqun4reu5zciq5iifdgcaj6fnnqki3lq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
20fa81d1aaeb9c0b8a15f71c939d71f6fac6e6a36e6fda77c5c23c50a773b08d
Formbook
2323e3fa9e42ca85d8c33196bbb4b5273403e1eae415e42be8b055df1a560337
Formbook
263fefe63ffef92b66516f9de917b4af09783ef5e3b6ba93b030d91c624c7925
Formbook
26e21e90ec6431d87ffd66ee6f0cce3c2f1854a98390670b1002332632f297de
Formbook
2829f8bf819c13d753f3c6b33726df8c46a533f3040b550a86ca0ab34f967e92
Formbook
3f3daa13de0dde36e87f536f9cbcabc3170a6ddc4bd261d8ad3d3cd8515f6790
Formbook
60c5937025d6f55a67d64ba824bb2ea0ba3aedd9dd949429544aaec829b98410
Formbook
6b45c7c7eff3349f69bbe88ee3209c8557e3ec32b1985e1a3053392354ae64ca
Formbook
8a525d55d517847b7379170a844775e1ea1ddc79816e4650d74787da63141d65
Formbook
bb07625dfa5d6a83097fe8ca97e3b03973086c48f05d0a4af05317ec4ad99449
Formbook
+ 2'762 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201026-ypga1x1aln/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.kumcal.com/fs8/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip d2b0f0b593f5d2e77b97c7d7eabf6069d33bfb3a7660daacb3c6fad0c53ddd53

Formbook

Executable exe b4aabf02da27e27110077d1d1cc28de4494ee4488750828cc2027c56b60a46d7

(this sample)

  
Dropped by
MD5 1d3a8afcd866a8e548fb85240581d628
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d2b0f0b593f5d2e77b97c7d7eabf6069d33bfb3a7660daacb3c6fad0c53ddd53
Cape
Cape
https://www.capesandbox.com/analysis/79185/

Comments