MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2e5850cea576bbc3c39a1e652f6c35e22229ab04ae734c5c7512b9ac3955964. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2e5850cea576bbc3c39a1e652f6c35e22229ab04ae734c5c7512b9ac3955964
SHA3-384 hash: 8309d5f04dc56ad8edba7c3ce07978b625105b49e47578d251c9cc305c88ab8f42aa627ea19bdd4cd8138ebfc6cf49ef
SHA1 hash: deef6a990b1f10491ca8a9fcacb7371016d40a7b
MD5 hash: bb1a12ee85261820ba991b4e7ef2fbb2
humanhash: two-lithium-lamp-four
File name:MAY2021POXo.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:929'280 bytes
First seen:2021-05-25 06:29:05 UTC
Last seen:2021-05-25 07:04:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:jk+Iv0uIlz2+3h+uLXKVkyRkos/Hzjf3sjuH1z1DZ:aKlh3hZ48f97l
Threatray 5'425 similar samples on MalwareBazaar
TLSH 2515592E102AF222C1A8C27D06C4642BED91DFB76131BD14ECD73F585739E4C799A26E
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/161669/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/791510
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 423907 Sample: MAY2021POXo.exe Startdate: 25/05/2021 Architecture: WINDOWS Score: 100 35 www.gethealthco.com 2->35 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 7 other signatures 2->49 11 MAY2021POXo.exe 4 2->11         started        signatures3 process4 file5 33 C:\Users\user\AppData\...\MAY2021POXo.exe.log, ASCII 11->33 dropped 59 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->59 61 Adds a directory exclusion to Windows Defender 11->61 63 Tries to detect virtualization through RDTSC time measurements 11->63 65 Injects a PE file into a foreign processes 11->65 15 MAY2021POXo.exe 11->15         started        18 powershell.exe 26 11->18         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 15->67 69 Maps a DLL or memory area into another process 15->69 71 Sample uses process hollowing technique 15->71 73 Queues an APC in another process (thread injection) 15->73 20 explorer.exe 15->20 injected 24 conhost.exe 18->24         started        process9 dnsIp10 37 reddeinvestigadores.com 104.238.68.196, 49731, 80 AS-26496-GO-DADDY-COM-LLCUS United States 20->37 39 www.reddeinvestigadores.com 20->39 41 2 other IPs or domains 20->41 51 System process connects to network (likely due to code injection or exploit) 20->51 26 msdt.exe 20->26         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 26->53 55 Maps a DLL or memory area into another process 26->55 57 Tries to detect virtualization through RDTSC time measurements 26->57 29 cmd.exe 1 26->29         started        process14 process15 31 conhost.exe 29->31         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e2e5850cea576bbc3c39a1e652f6c35e22229ab04ae734c5c7512b9ac3955964/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-05-25 06:29:19 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4lsykdhkk5v3ypbzuhtff5wdlyrcfgvqjlttjrohkevzvq4vlfsa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
20087dfd9482120735e4e37edc7307b91264632b0c9c7b50a058c100ba186ece
Formbook
290963ddb0862d90575e418931ac2cfacfbb79146f5846771e81046298bf75e8
Formbook
36ac85986999d60ef2bcf74e50d27daa1bfbf6c4815e6fb5e5dc1547d8dcb8c9
Formbook
53e1c28059f751b2b8ba98d5c6adcf3e028f3d2953d5355d452dfd30f0830af0
Formbook
c69e54b704c7d7e94faa9c3ea2519eef344e1099aa99271833bc56cae00ab8af
Formbook
ce27bdaa30fc5a712b41888b529f52c87f90b9d196b975d47ec9b5236b48cebc
Formbook
dd44eb26a328f1e86823339666e1b1237ad7b1d880694c1b8fb8164b931aa512
Formbook
e47fa9824fd9f5f8e8b42fb02f53cfbf57b7c784d54c9e76ed247a9d297835cf
Formbook
e8baf97ad51faed006287d1f01f921df0f677d4f056d35697158d30aa24ace9b
Formbook
f09416ef7aaab2c43c62ef77bb69c005ec4a57d4051586f5e7d8571e74fee41c
Formbook
+ 5'415 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook evasion rat spyware stealer trojan
Link:
https://tria.ge/reports/210525-n3yd5l3xz2/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Deletes itself
Looks for VMWare Tools registry key
Formbook Payload
Looks for VirtualBox Guest Additions in registry
Formbook
Malware Config
C2 Extraction:
http://www.northpointradon.com/clt/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e2e5850cea576bbc3c39a1e652f6c35e22229ab04ae734c5c7512b9ac3955964

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe e2e5850cea576bbc3c39a1e652f6c35e22229ab04ae734c5c7512b9ac3955964

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/161669/

Comments