MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e
SHA3-384 hash: 0901f121de992e18b1d4a93866e6f4423ff2c0051fb2d0a7680302582d90e60905b95bcfd24bd09d41fe7ecbf7cf2bd1
SHA1 hash: d9a3824d1a6d0fe4386c22b54c95d5873146f58e
MD5 hash: 522c178672d1855bf0ea66480ab732c1
humanhash: early-johnny-shade-ohio
File name:RFQ1101.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:969'728 bytes
First seen:2021-01-11 09:00:12 UTC
Last seen:2021-01-12 09:57:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:piPweXCLfUxnrvxMMyDDoyDI+19SLo7OqKoe:pwRPrvqMqo0I++LHqKoe
TLSH 7425D08734A48B58DE7D43F66216444423FAACBFE518E7095FC531E72AE6F810922F1B
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: cbdjo.cam
Sending IP: 111.90.159.32
From: Daniel Gomez <biuro@zurawie.info>
Reply-To: mzahar04@protonmail.com
Subject: FW:RFQ
Attachment: RFQ1101.zip (contains "RFQ1101.exe")

Intelligence

File Origin
# of uploads :
7
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ1101.exe
Verdict:
Malicious activity
Analysis date:
2021-01-11 09:07:11 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/5c32e59b-5b0d-4080-bb2d-54ed466eb9d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/111253/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/577756
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 337932 Sample: RFQ1101.exe Startdate: 11/01/2021 Architecture: WINDOWS Score: 100 33 www.rediscovercacao.com 2->33 35 rediscovercacao.com 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 6 other signatures 2->49 11 RFQ1101.exe 3 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\RFQ1101.exe.log, ASCII 11->31 dropped 59 Tries to detect virtualization through RDTSC time measurements 11->59 15 RFQ1101.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 37 shes-eco.com 199.34.228.42, 49734, 80 WEEBLYUS United States 18->37 39 www.violethousing.com 154.214.78.145, 49747, 80 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 18->39 41 6 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 help.exe 18->22         started        25 autoconv.exe 18->25         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 27 cmd.exe 1 22->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 09:00:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zopff7k5sgciipj5binxtzqe4hazxynatxyzyl2eiyznofwdb2pa._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210111-r2y62r8era/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.tokomw.com/wt8z/
Unpacked files
SH256 hash:
cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e
MD5 hash:
522c178672d1855bf0ea66480ab732c1
SHA1 hash:
d9a3824d1a6d0fe4386c22b54c95d5873146f58e
Link:
https://www.unpac.me/results/0c7f002d-4827-4138-832d-045953a6686b/
SH256 hash:
64a419709ad219ffc006bda776b650da486d55048d2fa34525f40227da0e5c86
MD5 hash:
88c0ec8398978fa2e4240f02765086ad
SHA1 hash:
5a5c4935b2d70e890c89ad9332365f4f4aa86f3c
Link:
https://www.unpac.me/results/0c7f002d-4827-4138-832d-045953a6686b/
SH256 hash:
b166eca380b6e972abdea9b17830da9d122cc9c8f59b4dc2af63ffa62d3989a4
MD5 hash:
c5290de73ef695fde6fd9d4780dfb733
SHA1 hash:
be148586142f353f07b63724775708c15802c024
Link:
https://www.unpac.me/results/0c7f002d-4827-4138-832d-045953a6686b/
SH256 hash:
c29b3ca19f371f7c0bbe0d3069eef3c7af1b11e7af836bf417dacd8c3074f6ce
MD5 hash:
d3a62b8f83bd99d3423e0db7bdb7e1b8
SHA1 hash:
3824ccacab2736e215da54a0f3b401f0123fd973
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/0c7f002d-4827-4138-832d-045953a6686b/
Parent samples :
cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e
c079b62cce0d0718c3b1f26c3f0f359a7df94acf7e75aea710979fe338ea1f4f
011e18466a15d6a18399caac2f3317b86ae944699f0ef8b332e9995b47767a6f
99a42bd8c8cfb6b3b69162c2f3f657b3b3972dd353338ff17accb1c9afcd5892
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 4cfd98870302aa2b3cf41404350f7523d5a32fc590c2f1fe9502baf2de732605

Formbook

Executable exe cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e

(this sample)

  
Dropped by
MD5 ca41b683ecbf70714772d76200f544f4
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4cfd98870302aa2b3cf41404350f7523d5a32fc590c2f1fe9502baf2de732605
Cape
Cape
https://www.capesandbox.com/analysis/111253/

Comments