MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b868ded573176e58f1d498447a375a73ff901fe072c28af6be9f851f8d0cdacc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b868ded573176e58f1d498447a375a73ff901fe072c28af6be9f851f8d0cdacc
SHA3-384 hash: 54246f9e87e09bad68147e2ed52d15e9396b9383c323764dcb7b081c91ce3569870cdd8b0cb94e34c5d4c2f6e7e4af2a
SHA1 hash: 174544715f33940357014b5fb1d8dbb850ad12fb
MD5 hash: 53f55c9bb0f3aaf5b7ee7f91eee82da8
humanhash: michigan-nitrogen-helium-connecticut
File name:Amacon Order Specification Requirement.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:460'288 bytes
First seen:2020-10-27 16:42:27 UTC
Last seen:2020-10-27 18:37:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:bBN003Jq8HcD+jrvu3KKyfCqIKd8Be92zaycIMBu4mDBGADL3IR:br13Uuc6jy3KKqCzKd8BC2h3MBu44WR
Threatray 3'505 similar samples on MalwareBazaar
TLSH 3DA4F168B8E1BAAFC597CD7365795C24A36068AB470FF202D0733BD4C48D7868F945E2
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail0.legislatiq.xyz
Sending IP: 161.35.234.94
From: Amacon Makgoka<amacon.makgoka@hotmail.com>
Subject: RE: 回复: Request for Quotation with reference: BINIF0865
Attachment: Amacon Order Specification Requirement.xz (contains "Amacon Order Specification Requirement.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/80041/
Detection(s):
SecuriteInfo.com.Heur.MSIL.Androm.9.11612.8333.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/514057
Signature
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 306145 Sample: Amacon Order Specification ... Startdate: 27/10/2020 Architecture: WINDOWS Score: 100 32 www.moosewrites.com 2->32 34 www.brunacarla.com 2->34 36 moosewrites.com 2->36 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Multi AV Scanner detection for dropped file 2->48 50 10 other signatures 2->50 9 Amacon Order Specification Requirement.exe 6 2->9         started        signatures3 process4 file5 28 C:\Users\user\AppData\...\TNbmUipeVFi.exe, PE32 9->28 dropped 30 C:\Users\user\AppData\Local\Temp\tmpA91.tmp, XML 9->30 dropped 12 Amacon Order Specification Requirement.exe 9->12         started        15 schtasks.exe 1 9->15         started        17 Amacon Order Specification Requirement.exe 9->17         started        process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 12->60 62 Maps a DLL or memory area into another process 12->62 64 Sample uses process hollowing technique 12->64 66 Queues an APC in another process (thread injection) 12->66 19 explorer.exe 12->19 injected 23 conhost.exe 15->23         started        process8 dnsIp9 38 www.aggies-gifts.com 119.28.6.251, 49735, 80 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN China 19->38 40 www.gdyongdong.com 154.89.191.113, 49727, 80 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 19->40 42 12 other IPs or domains 19->42 52 System process connects to network (likely due to code injection or exploit) 19->52 25 cscript.exe 19->25         started        signatures10 process11 signatures12 54 Modifies the context of a thread in another process (thread injection) 25->54 56 Maps a DLL or memory area into another process 25->56 58 Tries to detect virtualization through RDTSC time measurements 25->58
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b868ded573176e58f1d498447a375a73ff901fe072c28af6be9f851f8d0cdacc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 14:37:21 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xbun5vltc5xfr4outbchun22op7zah7aolbiv5v6t6cr7dim3lga._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
018bc083a823092a92d1c114dd649d85f63b19feda836cf32b44bc1e5c2f3aa9
Formbook
069d5be9ad8536747fa1075147dc61962d00ff0a13a0694bd9bc9946c94db225
Formbook
28e6b82a33e2b7e7ce02e684b90aae380c6e4ec244d111a5d16833ddf288981b
Formbook
4173f8d221525a3414e606763b5a61b649ec421c145e7a9bc683d3e8ff5d5c96
Formbook
89c0e9f07b4245f97dccad1b925e19ad1a436b61c5fce2f2f12bc05c0042dcbe
Formbook
adfaf60f2ef07cd0b6f3fdd429fb94e76376ebf41b0b615d2664449e6adb358e
Formbook
afbb4d08bfde470b3405f98f84a5be0456cf40edf8f08f7b4cb7a6cfcf5ee682
Formbook
b6138e4d197c59380c87723cb54c9cf7d5e4600a4273c98723470a57a591edda
Formbook
e85ece3cee51156974c3fb8f0e2c707dae2b51b0d2db9e5fb10531d2fdd76ca6
Formbook
f1a12a36b7cdbc3e0429105b407ca042b88c6113e39083abc39316ad835e41fe
Formbook
+ 3'495 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201027-75m5bn2x96/
Behaviour
Creates scheduled task(s)
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.flipgired.com/aqu2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b868ded573176e58f1d498447a375a73ff901fe072c28af6be9f851f8d0cdacc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

xz f032d97ce00120b8b0ded6cd477afb9e75b4997d9cd2f6ed51d40436cacdb77d

Formbook

Executable exe b868ded573176e58f1d498447a375a73ff901fe072c28af6be9f851f8d0cdacc

(this sample)

  
Dropped by
MD5 531cc920f831d198d11b10637b3cf9f2
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/80041/
  
Dropped by
SHA256 f032d97ce00120b8b0ded6cd477afb9e75b4997d9cd2f6ed51d40436cacdb77d

Comments