MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa
SHA3-384 hash: 7038aeffb8cfc0cc3d442c59a940aa82d89dac71df0db554fad7f67a43a52344b4164644942eaf3dd64fc1beedc0de1d
SHA1 hash: 57942b5fcf32aad9a3967e3345a0b66bf7a46d5a
MD5 hash: 938f2704c93492716b906e2d9a33ad8e
humanhash: wolfram-fanta-undress-low
File name:Booking voucher.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'076'229 bytes
First seen:2020-08-11 12:10:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 12288:3Qnk3GDYKGcblqZqZ8rgOItHSQhl3UrtRQGEZUL7NNMpEgCD/em/EmgS7PjZoQ9L:5AOcZSqZhOItr30AZa7kt5Io0UBXMT
Threatray 2'490 similar samples on MalwareBazaar
TLSH 70351202BBC2C872E8331933693563503D7D7C306F358A2FB3E4A56D9A711916A25FA7
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: franceloc-postfix.filnet.fr
Sending IP: 194.187.193.120
From: Cláudia Diniz <info@wip-hausschutz.de>
Reply-To: hg.virtucycling@gmail.com
Subject: GROUP CONFIRMATION
Attachment: Booking voucher.rar (contains "Booking voucher.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43337/
Detection(s):
SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Enabling the 'hidden' option for recently created files
Sending a UDP request
Creating a process from a recently created file
Creating a file in the %temp% directory
Adding an access-denied ACE
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/418760
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 261729 Sample: Booking voucher.exe Startdate: 11/08/2020 Architecture: WINDOWS Score: 100 50 Malicious sample detected (through community Yara rule) 2->50 52 Yara detected FormBook 2->52 54 Yara detected AntiVM autoit script 2->54 56 2 other signatures 2->56 14 Booking voucher.exe 72 2->14         started        process3 file4 46 C:\28442626\ldoxrfwdxr.pif, PE32 14->46 dropped 17 ldoxrfwdxr.pif 3 4 14->17         started        process5 signatures6 48 Contains functionality to inject code into remote processes 17->48 20 wscript.exe 1 17->20         started        process7 process8 22 ldoxrfwdxr.pif 2 20->22         started        process9 24 wscript.exe 1 22->24         started        process10 26 ldoxrfwdxr.pif 1 24->26         started        file11 44 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 26->44 dropped 60 Writes to foreign memory regions 26->60 62 Allocates memory in foreign processes 26->62 64 Sample uses process hollowing technique 26->64 66 Injects a PE file into a foreign processes 26->66 30 RegSvcs.exe 26->30         started        33 RegSvcs.exe 26->33         started        signatures12 process13 signatures14 68 Modifies the context of a thread in another process (thread injection) 30->68 70 Maps a DLL or memory area into another process 30->70 72 Sample uses process hollowing technique 30->72 74 2 other signatures 30->74 35 explorer.exe 30->35 injected 37 WerFault.exe 33->37         started        process15 process16 39 cscript.exe 35->39         started        signatures17 58 Tries to detect virtualization through RDTSC time measurements 39->58 42 cmd.exe 39->42         started        process18
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa/
Threat name:
Win32.Spyware.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 12:12:08 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=23dt2olscxjftp5wc2hjyctmfg5y42cfbgdx4dwgfk5azal2ex5a._file
Verdict:
malicious
Similar samples:
1678611ad4996f718c0a8998ce194dfe117bf47529c4ccad51a6816ecf4f1bb4
Formbook
37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61
Formbook
5c5e4e31bde29168e03fa8cce36bab9b577568137edab59f68f8968616546ed9
Formbook
62a7f441ba21aaa568fe700029fa32d6dd7eeb2ed0a7f7259a680f2aae65ee31
Formbook
9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
Formbook
a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445
Formbook
b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c
Formbook
c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa
Formbook
cbf010e4d58f12ac1a0ce0ef5e29636c13a3a6ee5b052aae7cad7e9a95448276
Formbook
f163f4788da0d445dec687df7d215b6af3c4bea10589fa268e6aff20ff335510
Formbook
+ 2'480 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat persistence spyware evasion trojan stealer family:formbook
Link:
https://tria.ge/reports/200811-63pvz9vgl2/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System policy modification
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Loads dropped DLL
Reads user/profile data of web browsers
Adds policy Run key to start application
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.fex-tracks.com/hx232/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 148b5dec9d4c47172b6ffc9a97264a746c84160f7561c98e63619f923f71bcf1

Formbook

Executable exe d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa

(this sample)

  
Dropped by
MD5 b059be10a733087589e3591c74922080
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/43337/
  
Dropped by
SHA256 148b5dec9d4c47172b6ffc9a97264a746c84160f7561c98e63619f923f71bcf1

Comments