MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cacdf1a59d452cff7cd9278e6aed55047b7867c740b858e41f36538f8ffd2a89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 7
| SHA256 hash: | cacdf1a59d452cff7cd9278e6aed55047b7867c740b858e41f36538f8ffd2a89 |
|---|---|
| SHA3-384 hash: | 2d8802258f3ae74afcd16ab4534381cc6e2c245826a86cfc572840167a64ec83251132d7fd2089e098abceb9e936240c |
| SHA1 hash: | e4e613fb3f4063ca721522a2ac381041b9fe37f2 |
| MD5 hash: | 6b44978ad0a6d1a02640111ceaebeaad |
| humanhash: | hamper-ten-uniform-ceiling |
| File name: | 23692 ANRITSU PROBE po 29288.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 2'788'048 bytes |
| First seen: | 2020-11-19 07:34:46 UTC |
| Last seen: | 2020-11-27 10:02:47 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 49152:LyC4tMo6v3soZYp2JwzqybHJywfpSU+Z4HRXYW:LyC4tMo6v3soZYp2JwzqybHMwfpSU64Z |
| Threatray | 3'570 similar samples on MalwareBazaar |
| TLSH | 73D527183C43305F798A01B05ADB5AE8A1DA3219167027399CAF647CD61DD7B7CEF8B2 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing Formbook:HELO: gmail.com
Sending IP: 156.96.62.91
From: Entang Hoerudin (Pur-Polymer) <sales@gmail.com>
Reply-To: fortunatodaniel.johndeere@gmail.com
Subject: Re: Fwd: Fwd: Fwd: Fwd: RFQ # 23692 ANRITSU PROBE/ po # 29288
Attachment: 23692 ANRITSU PROBE po 29288.zip (contains "23692 ANRITSU PROBE po 29288.exe")
Intelligence
File Origin
# of uploads :
26
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a window
Result
Gathering data
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Connects to a pastebin service (likely for C&C)
Hides threads from debuggers
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Status:
Malicious
First seen:
2020-11-19 03:07:29 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 3'560 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook evasion rat spyware stealer trojan
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Maps connected drives based on registry
Checks BIOS information in registry
Deletes itself
Windows security modification
Looks for VMWare Tools registry key
Formbook Payload
Looks for VirtualBox Guest Additions in registry
Modifies Windows Defender Real-time Protection settings
Windows security bypass
Turns off Windows Defender SpyNet reporting
Formbook
Malware Config
C2 Extraction:
http://www.goldenoilproducts.com/9d1o/
Unpacked files
SH256 hash:
cacdf1a59d452cff7cd9278e6aed55047b7867c740b858e41f36538f8ffd2a89
MD5 hash:
6b44978ad0a6d1a02640111ceaebeaad
SHA1 hash:
e4e613fb3f4063ca721522a2ac381041b9fe37f2
SH256 hash:
7246147673de8a1787ac24812ef13254da22a08614c4f92e757e583978bc8695
MD5 hash:
d3e34365008e1473f86b55300648fdef
SHA1 hash:
37af5a2dac8f32947c8df2578787cabc3b9c0c27
SH256 hash:
54a308c553260af53846340bc9c75f3f1ce16c76ae15d5219791b1dc9e48aa68
MD5 hash:
a03051e82d76961de475f4ceddd1fdd7
SHA1 hash:
576872950af1cc7bf6bf8557c532eb21f6dba1ea
Detections:
win_formbook_g0
win_formbook_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.