MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef
SHA3-384 hash: f488e8912dab7994d5c310c9335d2aa590334b77e81bbe7044851068425f851cbbf576f58f636fe2871778e0b89b2b6c
SHA1 hash: 6479838c581f60945250cd25786f43b19e2dc14c
MD5 hash: a8d20a8d6a2995da3c3c1976589df06a
humanhash: mexico-nitrogen-eight-failed
File name:PO. 2100002_pdf____________________________________.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:627'200 bytes
First seen:2021-09-14 17:27:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:snkUJWHCM2K4Cj1DUeUMgC14p7sftEKR/JVHZE5UjgweTc+grZ:o73C5DUeUXyK4xVH+mcweTc
Threatray 9'258 similar samples on MalwareBazaar
TLSH T19ED4E0203AFE9019F1B7EFB55FE4759A9A6EF7732B07945D108003860A23F41DD91A3A
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO. 2100002_pdf____________________________________.exe
Verdict:
Malicious activity
Analysis date:
2021-09-14 17:29:41 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/03f3308d-b839-4997-ab64-096254653f1a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187875/
Detection(s):
SecuriteInfo.com.ArtemisA8D20A8D6A29.29694.14683.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/617510e0db358dd15ed922a1/reports/ddeb568c-c2e3-4712-b4c8-e588f3a843d9/overview
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a6eef988-0396-47fd-975f-5b29998253d5
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/850866
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Double Extension
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 483297 Sample: PO. 2100002_pdf____________... Startdate: 14/09/2021 Architecture: WINDOWS Score: 100 33 www.studentlegalforms.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 14 other signatures 2->47 11 PO. 2100002_pdf____________________________________.exe 3 2->11         started        signatures3 process4 file5 31 PO. 2100002_pdf___...___________.exe.log, ASCII 11->31 dropped 59 Injects a PE file into a foreign processes 11->59 15 PO. 2100002_pdf____________________________________.exe 11->15         started        18 PO. 2100002_pdf____________________________________.exe 11->18         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 20 explorer.exe 15->20 injected process9 dnsIp10 35 midwestamericanwoman.com 108.167.140.157, 49797, 80 UNIFIEDLAYER-AS-1US United States 20->35 37 www.qireys.com 20->37 39 2 other IPs or domains 20->39 49 System process connects to network (likely due to code injection or exploit) 20->49 24 rundll32.exe 20->24         started        signatures11 process12 signatures13 51 Self deletion via cmd delete 24->51 53 Modifies the context of a thread in another process (thread injection) 24->53 55 Maps a DLL or memory area into another process 24->55 57 Tries to detect virtualization through RDTSC time measurements 24->57 27 cmd.exe 1 24->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2021-09-14 15:05:06 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zc2223wfog4txtt3nlrfkaowelvx7wsgfmbekx7xxwnkvlhctlxq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0655ee712ee939add7c23e011eb887fe70f085e1fea6df1dbeb07bc8df7ffdb7
Formbook
12f92a7d8e9599c69253c73bcf26dd3a1f8887fc397b71c408d9a0ddc22fb520
Formbook
35880c5210af5dca3edc22a693ab5f0cfcec0105cec988d930ab29fe09bd3461
Formbook
3f2cdc7783014a37d7ad61ee00c226d5221d4932f4113eb3590a9c9d0447b461
Formbook
57c14f3c817855d5ba2bfabaade5929697472d2989a8a9bcff46e50ac499a4dc
Formbook
78b11874a66b80ec78962b27c352a643d1a11c7f5cf9273f0db06df3f4f7e76c
Formbook
9da4d8126ac0c4c0b68066407e24cf1a36e06f0fc22ef87b0a464f90c1374095
Formbook
d457980cebdbfd785a77b0d09249f5bc8cca708f5b5e7fe607f1b538faf977c4
Formbook
d869fa27fd5d5a229609f218572f1625820cb8176ba6c1616714e40d4e6b7897
Formbook
e8be28fabd7cdb2d4e96137dae73bd9b227a86b654c696e9fd401cb37ec68267
Formbook
+ 9'248 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ajki rat spyware stealer trojan
Link:
https://tria.ge/reports/210914-v11kdagaf4/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.midwestamericanwoman.com/ajki/
Unpacked files
SH256 hash:
a8fedbd8c8a0b308afd57bc4f591019b80826b11ccf9bccbf0fb88bdde0d359c
MD5 hash:
f948d27d8c6a18aee0db5748db6c8068
SHA1 hash:
94aa66929acbd9268a80cac53fd89000e46d8f9b
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/f896c107-cf87-4ca4-bc78-ae50e64f96c5/
Parent samples :
12f92a7d8e9599c69253c73bcf26dd3a1f8887fc397b71c408d9a0ddc22fb520
57c14f3c817855d5ba2bfabaade5929697472d2989a8a9bcff46e50ac499a4dc
c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef
17b08e4418f813543e91ad18ae2e50ecfe40692d9b5dec854e94ec0abbc92b11
5da4f819e28c2b5e768a01c4c5010f0a335a86120ddb412583a2cd716bf95356
ae33000cbdc7cc10a8d86ce07727c8159d66a6707e2a453d996dc61c709de96f
05cc84b514af3890b82bbb8645e6f2ffd63782852f7ec8f00632cae804e7b443
137bbdb0a6a00a9167dff5cb670ec17aab82ae50392e12b1cdb6a08110d75285
b8393904a1a29cd147d934194b13fd0565dfd123b3868126386437536f15a0b4
SH256 hash:
ad4a7895d529d5164302bb88596964ab42ff125bf0f5544418c80b6d438cb587
MD5 hash:
43ababb6b0a02907aad43084f12b10d9
SHA1 hash:
b60ba705891d5a666d64300181b475a46714ffa8
Link:
https://www.unpac.me/results/f896c107-cf87-4ca4-bc78-ae50e64f96c5/
SH256 hash:
227f331f88ac61b93717ac7482ff6b4d76ff447577975b63a5d6610e8f3cbc07
MD5 hash:
95778c11032cee403fa9e613fc069a57
SHA1 hash:
599507dada30b0f1440bcc62b895ebaf217ba74a
Link:
https://www.unpac.me/results/f896c107-cf87-4ca4-bc78-ae50e64f96c5/
SH256 hash:
c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef
MD5 hash:
a8d20a8d6a2995da3c3c1976589df06a
SHA1 hash:
6479838c581f60945250cd25786f43b19e2dc14c
Link:
https://www.unpac.me/results/f896c107-cf87-4ca4-bc78-ae50e64f96c5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef

(this sample)

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/187875/

Comments