MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb21e5cc104a482d8d806a79b75f20781bde73dfb3ac59d6cd58fed12e9757e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb21e5cc104a482d8d806a79b75f20781bde73dfb3ac59d6cd58fed12e9757e5
SHA3-384 hash: 24f9c6a0c78f8b9759508bba9b97cd74483c0a6d91b88055bdda2d3b8a24bc7421611506bbb31a033812613cdbd4cae9
SHA1 hash: 24a56ecf724364cee4960112ce484052f943865e
MD5 hash: 073cde1da21b211a06ed18dde4ae8262
humanhash: mirror-pennsylvania-wolfram-pluto
File name:Sales Invoice no5283.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:669'696 bytes
First seen:2021-04-01 05:44:40 UTC
Last seen:2021-04-01 07:07:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:xRI8LNqjigD7Zf8ZAAmn4bjy3CxtyfBdG:xXyighfMmavgr
Threatray 4'451 similar samples on MalwareBazaar
TLSH 79E459273347BBAEDEB843B61452451033B1AD36F76AD50CA854724C5F7B6C08BEE262
Reporter cocaman
Tags:exe FormBook INVOICE

Intelligence

File Origin
# of uploads :
2
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Sales Invoice no5283.exe
Verdict:
Malicious activity
Analysis date:
2021-04-01 05:48:49 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/395b408d-1214-4589-8abe-678b71978685

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/130440/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.576.17749.26257.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/661614
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected FormBook malware
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Steal Google chrome login data
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 379742 Sample: Sales Invoice no5283.exe Startdate: 01/04/2021 Architecture: WINDOWS Score: 100 59 www.updatenewsdaily.online 2->59 61 updatenewsdaily.online 2->61 79 Found malware configuration 2->79 81 Malicious sample detected (through community Yara rule) 2->81 83 Antivirus detection for URL or domain 2->83 85 16 other signatures 2->85 11 Sales Invoice no5283.exe 7 2->11         started        signatures3 process4 dnsIp5 69 192.168.2.1 unknown unknown 11->69 51 C:\Users\user\AppData\...\wKVhhSnlONy.exe, PE32 11->51 dropped 53 C:\Users\...\wKVhhSnlONy.exe:Zone.Identifier, ASCII 11->53 dropped 55 C:\Users\user\AppData\Local\...\tmp5DB4.tmp, XML 11->55 dropped 57 C:\Users\...\Sales Invoice no5283.exe.log, ASCII 11->57 dropped 101 Adds a directory exclusion to Windows Defender 11->101 103 Injects a PE file into a foreign processes 11->103 16 Sales Invoice no5283.exe 11->16         started        19 powershell.exe 24 11->19         started        21 powershell.exe 25 11->21         started        23 schtasks.exe 1 11->23         started        file6 signatures7 process8 signatures9 71 Modifies the context of a thread in another process (thread injection) 16->71 73 Maps a DLL or memory area into another process 16->73 75 Sample uses process hollowing technique 16->75 77 Queues an APC in another process (thread injection) 16->77 25 explorer.exe 16->25 injected 29 conhost.exe 19->29         started        31 conhost.exe 21->31         started        33 conhost.exe 23->33         started        process10 dnsIp11 63 mbbuildersambalapuzha.com 209.133.204.250, 49746, 49747, 49748 HVC-ASUS United States 25->63 65 www.trumppowercatamarans.com 25->65 67 2 other IPs or domains 25->67 97 System process connects to network (likely due to code injection or exploit) 25->97 99 Uses netsh to modify the Windows network and firewall settings 25->99 35 netsh.exe 25->35         started        signatures12 process13 file14 45 C:\Users\user\AppData\...\8QLlogrv.ini, data 35->45 dropped 47 C:\Users\user\AppData\...\8QLlogri.ini, data 35->47 dropped 87 Detected FormBook malware 35->87 89 Tries to steal Mail credentials (via file access) 35->89 91 Tries to harvest and steal browser information (history, passwords, etc) 35->91 93 3 other signatures 35->93 39 cmd.exe 35->39         started        signatures15 process16 file17 49 C:\Users\user\AppData\Local\Temp\DB1, SQLite 39->49 dropped 95 Tries to harvest and steal browser information (history, passwords, etc) 39->95 43 conhost.exe 39->43         started        signatures18 process19
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bb21e5cc104a482d8d806a79b75f20781bde73dfb3ac59d6cd58fed12e9757e5/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-04-01 02:57:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
49
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmq6ltaqjjec3dmanj43oxzapan54467wowftvwnld7ncluxk7sq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3df2cc414d6cef0d973d0f47141a13be183a9da46e0455940affe5d24b9c2f9f
FormBook
5455b443ff5876acc7f13248570814b58e402911e049c1c3c1b1f6b9ac28ca95
FormBook
5601db85e43cf789bf5e9abb817a272782ea83fd6901c45fc07bbd453cb37fbc
FormBook
66f95fa3d4fb8e27a1beca62098133d93bf58ca36b83f58fced7f808ba1f282a
FormBook
7e0c1f10cfd225b16e83ecf7bc37a782441b8a96225fff827572bc3a81421bb9
FormBook
97d4de7a9478320c718f18c0f57349cfc611f5dee0aab5271304e4670e63d2a8
FormBook
9b438cfef66666b1c6513dab7cefd8f984621eaa1206272998215e9b445090fe
FormBook
b5ac8902c4d239f5f72366876e99a586d3aaafe45c9a9e098c8ded9a2db7615c
FormBook
bde11e5f0bd0e97d5fec3572de59518b300d0a27602c25d9699d8fc030022cb1
FormBook
e93a3705834cefd962e4dc4c2062e37e9ea42b9819cf11017857f5e36225d413
FormBook
+ 4'441 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210401-rhq65xe1rj/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.gloomyca.com/chue/
Unpacked files
SH256 hash:
d436034270fb2d5380e4fcecc1ee6c821a1701aed96045fa13f597da16be08fb
MD5 hash:
00cbf73d8b9f03417a3a32957ec64ed4
SHA1 hash:
b862eff1cf240a5ad5325fd258892e534484a6e8
Link:
https://www.unpac.me/results/f9f99500-cced-4a67-9eeb-578189c9c21e/
SH256 hash:
bb21e5cc104a482d8d806a79b75f20781bde73dfb3ac59d6cd58fed12e9757e5
MD5 hash:
073cde1da21b211a06ed18dde4ae8262
SHA1 hash:
24a56ecf724364cee4960112ce484052f943865e
Link:
https://www.unpac.me/results/f9f99500-cced-4a67-9eeb-578189c9c21e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bb21e5cc104a482d8d806a79b75f20781bde73dfb3ac59d6cd58fed12e9757e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 9de182ffc1d8d9f8a6305e64c1356a733e9af7d532b34845976300e31aca590a

FormBook

Executable exe bb21e5cc104a482d8d806a79b75f20781bde73dfb3ac59d6cd58fed12e9757e5

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 9de182ffc1d8d9f8a6305e64c1356a733e9af7d532b34845976300e31aca590a
Cape
Cape
https://www.capesandbox.com/analysis/130440/

Comments