MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3677d5791ac1a6939f2ab462201f257d9a4707f57bd6ee86d6b4dfa38378e3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3677d5791ac1a6939f2ab462201f257d9a4707f57bd6ee86d6b4dfa38378e3a
SHA3-384 hash: ffc9b90b4be842ececcb3c40a2947661f98d3da349824c225d5f6f4d54a23efbb0117b04a9794c41eef93714d842a165
SHA1 hash: 9f0ff48be7e4a69e78ff865b183de6dbe5370d6b
MD5 hash: b5eadea0f02511322169ceb8d4dcb577
humanhash: saturn-nuts-california-artist
File name:Lista e porosive.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:982'016 bytes
First seen:2021-06-10 06:26:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 44e7313214ce4e94380708f576c657ac (1 x AveMariaRAT, 1 x RemcosRAT, 1 x Formbook)
ssdeep 12288:9esfulGnsITxBM7YebagaQ5V0fZOX7miG8XjHn+D2vWbP8tqX0uNb+T0HXX+jBnl:9epGLM7Yebb5CEZPi0WPiq/XQBmE
Threatray 5'758 similar samples on MalwareBazaar
TLSH 5E259E29B3504436D86727F98C4BB7A5693FBE013A18DC4E6BB439497E3A3D0391D09B
Reporter Racco42
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Lista e porosive.exe
Verdict:
Malicious activity
Analysis date:
2021-06-10 09:23:27 UTC
Tags:
installer trojan formbook stealer
Link:
https://app.any.run/tasks/c5cae734-62b9-4c43-a97a-29cf1e74537c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/165751/
Detection(s):
Win.Trojan.Pwsx-9870156-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader39.42966.13271.2647.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/799975
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Detected FormBook malware
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Process Start Without DLL
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 432371 Sample: Lista e porosive.exe Startdate: 10/06/2021 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for domain / URL 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 8 other signatures 2->46 10 Lista e porosive.exe 17 2->10         started        process3 dnsIp4 38 cdn.discordapp.com 162.159.129.233, 443, 49715, 49716 CLOUDFLARENETUS United States 10->38 60 Writes to foreign memory regions 10->60 62 Allocates memory in foreign processes 10->62 64 Creates a thread in another existing process (thread injection) 10->64 66 Injects a PE file into a foreign processes 10->66 14 ieinstal.exe 10->14         started        signatures5 process6 signatures7 68 Modifies the context of a thread in another process (thread injection) 14->68 70 Maps a DLL or memory area into another process 14->70 72 Sample uses process hollowing technique 14->72 74 Queues an APC in another process (thread injection) 14->74 17 explorer.exe 14->17 injected process8 dnsIp9 34 www.janewagtus.com 116.203.86.180, 49730, 49731, 49732 HETZNER-ASDE Germany 17->34 36 www.jialingjiangpubu.com 17->36 48 System process connects to network (likely due to code injection or exploit) 17->48 21 rundll32.exe 1 18 17->21         started        signatures10 process11 file12 30 C:\Users\user\AppData\...\941logrv.ini, data 21->30 dropped 32 C:\Users\user\AppData\...\941logri.ini, data 21->32 dropped 50 Detected FormBook malware 21->50 52 Creates an undocumented autostart registry key 21->52 54 Tries to steal Mail credentials (via file access) 21->54 56 4 other signatures 21->56 25 cmd.exe 2 21->25         started        signatures13 process14 signatures15 58 Tries to harvest and steal browser information (history, passwords, etc) 25->58 28 conhost.exe 25->28         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3677d5791ac1a6939f2ab462201f257d9a4707f57bd6ee86d6b4dfa38378e3a/
Threat name:
Win32.Infostealer.BestaFera
Create hunting rule
Status:
Malicious
First seen:
2021-06-09 06:19:41 UTC
AV detection:
21 of 46 (45.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yntx2v4rvqngsopsvndceapsk7m2i4d7k66w52dnnng7uobxry5a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
17dba25e41a7c193a9abafca9194574ff970d56c1defec9a1d4fed04590d9ec4
Formbook
2f2c77d7bcd0fbf80b63b7b2e60b8192130c285bce2f946f021dee83954254e6
Formbook
3e57610037924c21124e91f187f11f45e1d1cc44de45a1d965cd29a92d56f450
Formbook
3fda3b75f031e3800ff8714a936af691dafd64ae8f08a2d5cc8df19363391c09
Formbook
5281533c78892f2b571668ef9c770ce9c04ee249397040db9b5975ed47601474
Formbook
92b86a3617c61eedc7c080cf52283c060da54017337b6376790e5a34a360fdfa
Formbook
c3938c98477bb13ecf6d7fa89e31ccd6fa2324dc0d859b25de6dfa5c1c4b5887
Formbook
cff20b43e7c12b27611bb33a9b77357af443ede89860134e43d48095949abd15
Formbook
ddf9f373e5735daeaea928c67bf342b9a71089ef06b4b9ec4fd8f593f34969e0
Formbook
eca866db6ef1c1359d34584e896e1c712d70b35ecc2074bc7743e407af792077
Formbook
+ 5'748 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/210610-nf57wsj9ge/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.joomlas123.info/3nop/
Unpacked files
SH256 hash:
5381c6276fc0f552d71efe7fb4d43a9e1a1e776c4cb7a572f72207b777ff2a32
MD5 hash:
3e9b080fb62948db627a904b7af653ea
SHA1 hash:
93a66126bdeb846724b41d44c6a7cac15c5ed636
Link:
https://www.unpac.me/results/dfc473f2-955d-460b-af85-fa07bdb1c5b0/
SH256 hash:
c3677d5791ac1a6939f2ab462201f257d9a4707f57bd6ee86d6b4dfa38378e3a
MD5 hash:
b5eadea0f02511322169ceb8d4dcb577
SHA1 hash:
9f0ff48be7e4a69e78ff865b183de6dbe5370d6b
Link:
https://www.unpac.me/results/dfc473f2-955d-460b-af85-fa07bdb1c5b0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3677d5791ac1a6939f2ab462201f257d9a4707f57bd6ee86d6b4dfa38378e3a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe c3677d5791ac1a6939f2ab462201f257d9a4707f57bd6ee86d6b4dfa38378e3a

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/165751/

Comments