MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5b7a34c6294b2505366e81e4bcaa48943ddc338a1f78ae8f990e3dcf413182a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5b7a34c6294b2505366e81e4bcaa48943ddc338a1f78ae8f990e3dcf413182a
SHA3-384 hash: 9dfff28a436a9b2a8be5448d45d432ce16ff4e59d8abdceb9f6a5e1f7c5d86616c5520faa7c9170df16d80ba9dceb3f1
SHA1 hash: e29259b07f11d5b19c0b186ae9d7a405ca2a1845
MD5 hash: e740f5933346e9e3c1cd520dc40d3e39
humanhash: network-kansas-fruit-march
File name:presh.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:609'280 bytes
First seen:2020-09-08 06:11:53 UTC
Last seen:2020-09-08 06:41:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:7qP8mlRRGTUOkOXP/fowSOe+5ofLBXEl5YZ7ZbQTRO7nziyHaLr6X1uOseQFdGL+:7qP8uNOkM3f9e+eLBXEO7VQTOF
TLSH A4D4BECC321172EFC85BD0729EAA1CB4EA50757B531B5613A02325EE9A4D89BCF185F3
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: noorleather.com
Sending IP: 103.149.12.183
From: "Janice (李会娟 )" <import@noorleather.com>
Subject: 答复: analyze QU 2020083109
Attachment: 0000491219.xlsx

FormBook payload URL.
http://103.149.12.183/presh.exe

FormBook C2:
http://www.jramfox.info/5gb/

Intelligence

File Origin
# of uploads :
2
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/57781/
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.12901.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Launching cmd.exe command interpreter
Forced shutdown of a system process
Unauthorized injection to a system process
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d5b7a34c6294b2505366e81e4bcaa48943ddc338a1f78ae8f990e3dcf413182a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-08 06:13:05 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2w32gtdcsszfau3g5apexsverfb53qzyuh3yv2hzsdr5z5atdava._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200908-hnj6x9cj2e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.jramfox.info/5gb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d5b7a34c6294b2505366e81e4bcaa48943ddc338a1f78ae8f990e3dcf413182a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Excel file xlsx f8802b11e8dd872f8051fb076a40106d856f80338d33d3abbca993a9f8204dc1

Formbook

Executable exe d5b7a34c6294b2505366e81e4bcaa48943ddc338a1f78ae8f990e3dcf413182a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/455371/
  
Dropped by
MD5 4c2b41ea9dd11267dda338102d9d0b43
  
Dropped by
SHA256 f8802b11e8dd872f8051fb076a40106d856f80338d33d3abbca993a9f8204dc1
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/57781/

Comments