MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb791f412d5932e2488323eb036e19c6f495d1e89f6fcbbd0f4b81efba432378. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb791f412d5932e2488323eb036e19c6f495d1e89f6fcbbd0f4b81efba432378
SHA3-384 hash: 4c0292ad15a4cb99c339dd0911951901e734d63d3a6c46ea955b4228a8687196349e7a0a05231c4302774876b061b9ae
SHA1 hash: 64b49f2fbc2bbc943ddfc3515ecb6a3092ebf47c
MD5 hash: c463ffa063af5cde7ad2a0aaf726854a
humanhash: fix-pluto-thirteen-mexico
File name:Busan Korea.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'201'664 bytes
First seen:2021-01-18 08:29:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:kvDR7U3p6dJxB5q6EV4EUg/e47qB8Jyv60CZ:kv97U0dJxC6i4EUg/e47qB6yXG
Threatray 3'562 similar samples on MalwareBazaar
TLSH 66458C1193DC9B20EFBC57F49810826067A9B946B674E36CF8BD70D25F739A4489FB80
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: cbdjo.cam
Sending IP: 111.90.159.32
From: So-young Han <Han@cbdjo.cam>
Subject: AW: AW: AW: PO NO. H6400003000
Attachment: Busan Korea.rar (contains "Busan Korea.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Busan Korea.exe
Verdict:
Malicious activity
Analysis date:
2021-01-18 08:42:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a9683a6a-0364-4693-9d46-1f2ff5654918

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/112483/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/583535
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 340803 Sample: Busan Korea.exe Startdate: 18/01/2021 Architecture: WINDOWS Score: 100 42 www.valiantbranch.com 2->42 44 www.ketonesconnect.com 2->44 46 2 other IPs or domains 2->46 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Sigma detected: Scheduled temp file as task from temp location 2->60 62 9 other signatures 2->62 11 Busan Korea.exe 7 2->11         started        signatures3 process4 file5 34 C:\Users\user\AppData\...\uAqFmidTWJQD.exe, PE32 11->34 dropped 36 C:\Users\...\uAqFmidTWJQD.exe:Zone.Identifier, ASCII 11->36 dropped 38 C:\Users\user\AppData\Local\...\tmpA012.tmp, XML 11->38 dropped 40 C:\Users\user\AppData\...\Busan Korea.exe.log, ASCII 11->40 dropped 72 Injects a PE file into a foreign processes 11->72 15 Busan Korea.exe 11->15         started        18 schtasks.exe 1 11->18         started        signatures6 process7 signatures8 74 Modifies the context of a thread in another process (thread injection) 15->74 76 Maps a DLL or memory area into another process 15->76 78 Sample uses process hollowing technique 15->78 80 Queues an APC in another process (thread injection) 15->80 20 explorer.exe 15->20 injected 24 conhost.exe 18->24         started        process9 dnsIp10 48 www.promotionalplacements.com 91.195.240.94, 49748, 80 SEDO-ASDE Germany 20->48 50 africaglobalexim.com 160.153.128.42, 49750, 80 GODADDY-AMSDE United States 20->50 52 3 other IPs or domains 20->52 64 System process connects to network (likely due to code injection or exploit) 20->64 26 chkdsk.exe 20->26         started        signatures11 process12 dnsIp13 54 192.168.2.1 unknown unknown 26->54 66 Modifies the context of a thread in another process (thread injection) 26->66 68 Maps a DLL or memory area into another process 26->68 70 Tries to detect virtualization through RDTSC time measurements 26->70 30 cmd.exe 1 26->30         started        signatures14 process15 process16 32 conhost.exe 30->32         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cb791f412d5932e2488323eb036e19c6f495d1e89f6fcbbd0f4b81efba432378/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zn4r6qjnlezoesedepvqg3qzy32jlupit5x4xpipjoa67osden4a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
5e31a4916e479c18347d59e0a98dc12738efb5acbad3ba3e677fb24fd87e7adc
Formbook
67710323c3dd7ba7cc04081512bdb304b4d7edd72975f2891c1f5893fdb75a8a
Formbook
6b090efc032911140a9b027ae65b205eb4b6aef2ab0dec995e473470f6706240
Formbook
796ef4749cd2e52790d92fbe9dd4cdf14159dfdb2155984a2bf424bd237ed457
Formbook
9972434ebdd96cf98cbc8849f08d6ca3120e5cf2553b3416bc0fccc5396c74b5
Formbook
9c9adb16561049288fd3f771b795890e2f9efa66c2eeb121cea935e7f843ce46
Formbook
b70435027f6fd88676d6b54087422fd696f41bffb783a8248affee5e6a62a97d
Formbook
cdcc8531c42e3ede33c0ecbcb82f7a6e5445e959eee3796475258df830a18813
Formbook
f3b3138f016ca71657f2289fa5dec16bec138c3ed5632c244e6e36161106b45d
Formbook
f3dd0364478f5e8db5e914033bf34cd7e0a1cc3a66698883a3798ef35f61a36c
Formbook
+ 3'552 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader loader rat spyware stealer trojan
Link:
https://tria.ge/reports/210118-zlx85kfapx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Formbook
Xloader
Malware Config
C2 Extraction:
http://www.valiantbranch.com/0wdn/
Unpacked files
SH256 hash:
1d6ecf546163882d34d4bb2b7afa3889506ca3036ed536c4ed972ed89bdf5035
MD5 hash:
fb169513679d349cb2a7e4121bacfd4a
SHA1 hash:
26619d7ce0a175b9fc4fbfd7f4b105050562924f
Link:
https://www.unpac.me/results/6c3cfa49-5126-4d0b-b45b-d12040bf8d85/
SH256 hash:
cb791f412d5932e2488323eb036e19c6f495d1e89f6fcbbd0f4b81efba432378
MD5 hash:
c463ffa063af5cde7ad2a0aaf726854a
SHA1 hash:
64b49f2fbc2bbc943ddfc3515ecb6a3092ebf47c
Link:
https://www.unpac.me/results/6c3cfa49-5126-4d0b-b45b-d12040bf8d85/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb791f412d5932e2488323eb036e19c6f495d1e89f6fcbbd0f4b81efba432378

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar c5865bbb87d05f03a727ffd2d0d655b535008aaa757974f1713aa1798104fecb

Formbook

Executable exe cb791f412d5932e2488323eb036e19c6f495d1e89f6fcbbd0f4b81efba432378

(this sample)

  
Dropped by
MD5 c84373de0221571550a5bd8251e0bd2d
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/112483/
  
Dropped by
SHA256 c5865bbb87d05f03a727ffd2d0d655b535008aaa757974f1713aa1798104fecb

Comments