MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb9826fb54d83c293531c905827920511bd9d7b259da01ac1e593d9d10aec334. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb9826fb54d83c293531c905827920511bd9d7b259da01ac1e593d9d10aec334
SHA3-384 hash: 9e55bcba9a0f0818cebc8d9e9d67cfe8abef7703c611b292484341ad0383b59ae1bab2e12e53ead13178435ecf47cdf6
SHA1 hash: d7a9d45018f07eb958ce2b1725aeb7c18aef5489
MD5 hash: 0f4041b3702fed0479400975bd7d9b18
humanhash: blossom-fanta-michigan-pennsylvania
File name:Transfer Form.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:588'800 bytes
First seen:2020-10-12 08:57:47 UTC
Last seen:2020-10-12 12:24:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:lW42It/UzMZJU/KX01lEjinnA0uqYu3IJilBwaRDY:l2K/Uzi4Y0AinNuUIJ+BxD
Threatray 2'422 similar samples on MalwareBazaar
TLSH CFC4F1323758AB52E97ED7BD043160046BF1E1A6EB21DB2A7D9480DE16B6F44C772B03
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: mnr.hindustan@seabreezemarine.com
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: Transfer Form.zip (contains "Transfer Form.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70024/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Launching cmd.exe command interpreter
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/488227
Signature
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cb9826fb54d83c293531c905827920511bd9d7b259da01ac1e593d9d10aec334/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 08:59:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zomcn62u3a6csnjrzecye6jaken5tv5slhnadla6le6z2efoym2a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
48fb5ca3a7323643cd3cab475e1e7615bf619ef568c2673f7e61e128d263a114
Formbook
4ba0d07d32c048141100317f95bd6dd8b791ba9c6608730b8408530490a13922
Formbook
765c1e7486aedffd7021ae5f15c86e549c7b796a5025249781f9c8a6327f4037
Formbook
ba2bf5801650d3b1efe26350bdca102f606dc7622ad4908c414789ef5c0f24b3
Formbook
c611c4446e4604531e8e096508422fd01b23d26c424f9625d049e7edaf4f566a
Formbook
c65fe5438e02a697fa15a0c17e76885ffb3a22eb92d47359f0519196d8b9c104
Formbook
d4014ac2689b47f11708425cad3d8aa02dd05ee6d6745006156dffbe0a27b4be
Formbook
db53a27c43dddb419e9d058e6288f3c1e7fc7e4bd62e3bb048e7103dcf79d682
Formbook
ec4ee2fa916e9fc280f06af0ceded7835693723ebbc6c60bd6e371b5d4ad006a
Formbook
f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c
Formbook
+ 2'412 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201012-jkjh6kv6x2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Gathers network information
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.purebodyrecovery.com/rhk/
Unpacked files
SH256 hash:
cd76f9ffbe66ab6b4ddc132e9c9a0c80a71619ec4835d10b04b4e8df138feb02
MD5 hash:
8181d6cf4825d1023a7ce0112adf1ab1
SHA1 hash:
bc4d9b8b72aee6c3bad9d3af8ab16ba6be624fac
Link:
https://www.unpac.me/results/045744c5-ce42-41d3-8e52-42d853d2bb45/
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/045744c5-ce42-41d3-8e52-42d853d2bb45/
SH256 hash:
208885ed10171989df90700988cfe93c1bb278b773bebaddcb4b8542456d2642
MD5 hash:
6c142f9f48eafed651d34e5776c54377
SHA1 hash:
ba0a4da1c8094497bdf270421ca97ccf4292c7a4
Link:
https://www.unpac.me/results/045744c5-ce42-41d3-8e52-42d853d2bb45/
SH256 hash:
70d85aee4c61997e4ebc5cfd635cd3cdfd70ede0b9b9a974344c7321d6e2b371
MD5 hash:
bc610ef84bf5c478554a217b01229506
SHA1 hash:
e5de402d6b5c323d6b8293e8549905b2f4e05761
Link:
https://www.unpac.me/results/045744c5-ce42-41d3-8e52-42d853d2bb45/
SH256 hash:
00fbae02cdcd2438dbc3a8758e8e5dcc8bb86b26162c6b23c1edae3f0ccc918f
MD5 hash:
3c5e36539ea6b6ea02774b082f151ac6
SHA1 hash:
b0ed5a1f3bb540f8c5a08ec5909ec5f1fa59fcf5
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/045744c5-ce42-41d3-8e52-42d853d2bb45/
Parent samples :
c65fe5438e02a697fa15a0c17e76885ffb3a22eb92d47359f0519196d8b9c104
ec4ee2fa916e9fc280f06af0ceded7835693723ebbc6c60bd6e371b5d4ad006a
ba2bf5801650d3b1efe26350bdca102f606dc7622ad4908c414789ef5c0f24b3
48fb5ca3a7323643cd3cab475e1e7615bf619ef568c2673f7e61e128d263a114
cb9826fb54d83c293531c905827920511bd9d7b259da01ac1e593d9d10aec334
8ce26cc2fb22fe3d89d7f4bd9ea925f0719ff9208b4e37b1f71b9d4e810bcc0c
SH256 hash:
cb9826fb54d83c293531c905827920511bd9d7b259da01ac1e593d9d10aec334
MD5 hash:
0f4041b3702fed0479400975bd7d9b18
SHA1 hash:
d7a9d45018f07eb958ce2b1725aeb7c18aef5489
Link:
https://www.unpac.me/results/045744c5-ce42-41d3-8e52-42d853d2bb45/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb9826fb54d83c293531c905827920511bd9d7b259da01ac1e593d9d10aec334

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip ef88e6e9f27df246458b0e852bdc6618e4f5914b78cca439a2fd13b30c9a0c52

Formbook

Executable exe cb9826fb54d83c293531c905827920511bd9d7b259da01ac1e593d9d10aec334

(this sample)

  
Dropped by
MD5 a05b33f4d5821f3f900449c5f7073ddf
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/70024/
  
Dropped by
SHA256 ef88e6e9f27df246458b0e852bdc6618e4f5914b78cca439a2fd13b30c9a0c52

Comments