MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa
SHA3-384 hash: b32d575e0fe54449717702e5929a1c2f17da0e71279d75b7b37fb848ae87e712c6890fa5932de24c26756fb218e3b15d
SHA1 hash: c8003fa6be60e8bbfa8ca9f29dac94714a0b0d4c
MD5 hash: 846ec2b8ab35bf765b1c318cfb1f479e
humanhash: oscar-tango-king-item
File name:Booking confirmation.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'021'792 bytes
First seen:2020-08-04 11:21:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 24576:bNA3R5drXdFdAXDzcSnntHxzAY0pMY5aRcKX/1:G5NAzzcGLzAbG2ab1
Threatray 2'489 similar samples on MalwareBazaar
TLSH 29251202B7C284F1E9721D32583AB7507DBC7C304E34CB6FB3D59A68DA30A919625B67
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vm01.elinet.it
Sending IP: 80.241.141.60
From: BOOKING.COM <admin@booking.com>
Reply-To: finance.booking.com@outlook.com
Subject: GROUP CONFIRMATION
Attachment: Booking confirmation.rar (contains "Booking confirmation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38582/
Detection(s):
Win.Dropper.NetWire-9102409-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Sending a UDP request
Creating a file in the %temp% directory
Adding an access-denied ACE
Launching a process
Launching cmd.exe command interpreter
Deleting a recently created file
Setting browser functions hooks
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/409245
Signature
Contains functionality to inject code into remote processes
Drops PE files with a suspicious file extension
Malicious sample detected (through community Yara rule)
Sleep loop found (likely to delay execution)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 256891 Sample: Booking confirmation.exe Startdate: 04/08/2020 Architecture: WINDOWS Score: 72 25 Malicious sample detected (through community Yara rule) 2->25 27 Yara detected FormBook 2->27 29 Drops PE files with a suspicious file extension 2->29 8 Booking confirmation.exe 80 2->8         started        process3 file4 21 C:\34606469\mplh.pif, PE32 8->21 dropped 11 mplh.pif 3 8->11         started        process5 file6 23 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 11->23 dropped 31 Contains functionality to inject code into remote processes 11->31 33 Writes to foreign memory regions 11->33 35 Sleep loop found (likely to delay execution) 11->35 15 RegSvcs.exe 11->15         started        17 RegSvcs.exe 11->17         started        signatures7 process8 process9 19 WerFault.exe 15->19         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:23:07 UTC
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yz76cmcnmrk3zls4a6z7p7wolbdcrmc5fbvwrwtoqutv65uvwkva._file
Verdict:
malicious
Similar samples:
0418e3df48284da14ab4d183c6d5d6ec3f37e3bd2b7be5439840d8409e620c32
FormBook
0cd1ca47d2e04de65562e1ba4d8ce4545ee486999f8f0eb7adc880c7fb7fc9b8
FormBook
5c5e4e31bde29168e03fa8cce36bab9b577568137edab59f68f8968616546ed9
FormBook
9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
FormBook
a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445
FormBook
b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c
FormBook
d35f40a630b2e4b24ec76c354e1e66d927afe339aaba45ff3c750ed52193c910
FormBook
d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa
FormBook
f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510
FormBook
fb0d1b0c62204ebfb2e04bcc607e562f398bf0cd40a275ace02ca34bed1d355d
FormBook
+ 2'479 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook evasion persistence
Link:
https://tria.ge/reports/200804-q3pzs4p3sj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious behavior: EnumeratesProcesses
Gathers network information
System policy modification
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Reads user/profile data of web browsers
Loads dropped DLL
Adds policy Run key to start application
Executes dropped EXE
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 5a40f4c70cc4bf22204a97d56b5e2a43a32cb2a87bc3a0ff3eba286c69037b9e

FormBook

Executable exe c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa

(this sample)

  
Dropped by
MD5 72a5f91ce3acd274446245e6bd848182
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38582/
  
Dropped by
SHA256 5a40f4c70cc4bf22204a97d56b5e2a43a32cb2a87bc3a0ff3eba286c69037b9e

Comments