MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf84393caee9b769b516681ec8998afe26c22255c405ea9a027608ccf38ea36b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	bf84393caee9b769b516681ec8998afe26c22255c405ea9a027608ccf38ea36b
SHA3-384 hash:	e2f69bcb46d161edfdb9c119149d22155086717cead297d982a6fc4bfa6438aa8c17c51e022cc76997d72f8a8cef329a
SHA1 hash:	8a017b7cfc0128c584b64cf8b531e9387a211858
MD5 hash:	13b21115bd414b3cff0365351398e92a
humanhash:	oregon-virginia-carpet-angel
File name:	13b21115bd414b3cff0365351398e92a.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	843'264 bytes
First seen:	2021-02-19 11:17:12 UTC
Last seen:	2021-02-19 14:00:32 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	12288:oLXHsXw4voVatmZZgVm2WCDSZcWl76imBp4EmJi:QXHGTvcA4ZSm2ZymT4EmJi
Threatray	3'843 similar samples on MalwareBazaar
TLSH	08058C2A7B844FD6C560FBBAC297421423F1F5DB5322F74B9FA909E045231C22E7E625
Reporter	abuse_ch
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

132

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/117996/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Generic.ch.16178.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Creating a window

Sending a UDP request

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file

Launching a process

Launching cmd.exe command interpreter

Setting browser functions hooks

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Unauthorized injection to a system process

Unauthorized injection to a browser process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/612623

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf84393caee9b769b516681ec8998afe26c22255c405ea9a027608ccf38ea36b/

Threat name:

ByteCode-MSIL.Trojan.FormBook

Status:

Malicious

First seen:

2021-02-19 05:31:46 UTC

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=x6cdspfo5g3wtniwnapmrgmk7ytmeisvyqc6vgqcoyemz44ounvq._file

Verdict:

malicious

Label(s):

formbook

Formbook

3e98d7f59e495ddfa5140a50f70347bb4a56296ca2dcb6602f65ebb4e4a0373b

Formbook

474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f

Formbook

6275a11bba81d765d92e670a44888734f565eb11fd137a0ff852ed5df68c1d67

Formbook

6f827b68129d30609057c2e6b36be05649fce91d6bc8ee3d3566ca5c6aba562b

Formbook

9b2c6f08cd9a4e3b144422de4d540290542ce50239f2c85697a036a461b25264

Formbook

b042e4bdfe19df2aa474fd5e2294aecc9a07d447c96466db7a7e20316d885634

Formbook

b57c9384280389b262d09cb4fa5b5465aadd4aaba2afb6d48c5d6e7c3f8d923e

Formbook

d3664113994262962936ebe74d0355986970def0cd0bcdcf088fe102047df9ba

Formbook

e13acda03eb4829793beb5c0664d5752663b7ef5ae72b63724e7eaf189a9fec4

Formbook

+ 3'833 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook agilenet rat spyware stealer trojan

Link:

https://tria.ge/reports/210219-nkk146hpan/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.triumphantlytransformedbk.com/pep/

Unpacked files

SH256 hash:

bf84393caee9b769b516681ec8998afe26c22255c405ea9a027608ccf38ea36b

MD5 hash:

13b21115bd414b3cff0365351398e92a

SHA1 hash:

8a017b7cfc0128c584b64cf8b531e9387a211858

Link:

https://www.unpac.me/results/d934de85-eb66-428f-be7c-2de7e8de1721/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bf84393caee9b769b516681ec8998afe26c22255c405ea9a027608ccf38ea36b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator