MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6
SHA3-384 hash: ba67049b47bd91e970f8aef986c5260b1bb24be0123eb1178f11917cded2759498095aa9661d2c91e3544683fae91952
SHA1 hash: 67e7f7206f0fd88af81dec81bc07e19c78849272
MD5 hash: f1195195c48e9e841b5405ef68ba4763
humanhash: fix-triple-october-eighteen
File name:Purchase order nr.0119-21.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'099'776 bytes
First seen:2021-01-19 07:30:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:WTV31J4DeNjbHboECo42Y1e0LwcpVBy99BzQL02w7wlO9OHz6eg:G3ucbUpgYUGwcnByttlMlOk2h
Threatray 3'536 similar samples on MalwareBazaar
TLSH 8535AD0222987F18F5BD5737D9B8445487F9FC11DB21C92EACE539DE4AB2BE0A607306
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: smtp.nexconn.com.br
Sending IP: 77.48.43.64
From: Israel Carvalho <sales3@nexconn.com.br>
Subject: Purchase order nr. 1054-21
Attachment: Purchase order nr.0119-21.pdf.gz (contains "Purchase order nr.0119-21.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase order nr.0119-21.exe
Verdict:
Malicious activity
Analysis date:
2021-01-19 07:48:54 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/ea8ad829-9ce8-47f5-860d-78618a9abad4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/112782/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.tc.32750.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/584712
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 341392 Sample: Purchase order nr.0119-21.exe Startdate: 19/01/2021 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->36 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 8 other signatures 2->42 10 Purchase order nr.0119-21.exe 3 2->10         started        process3 file4 28 C:\...\Purchase order nr.0119-21.exe.log, ASCII 10->28 dropped 52 Injects a PE file into a foreign processes 10->52 14 Purchase order nr.0119-21.exe 10->14         started        signatures5 process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 Queues an APC in another process (thread injection) 14->60 17 explorer.exe 14->17 injected process8 dnsIp9 30 gamoauction.com 192.185.98.253, 49740, 80 UNIFIEDLAYER-AS-1US United States 17->30 32 www.cnhremandealerservice.com 74.208.236.234, 49725, 80 ONEANDONE-ASBrauerstrasse48DE United States 17->32 34 8 other IPs or domains 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 cscript.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:01:10 UTC
AV detection:
8 of 44 (18.18%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4vx6q4g2gak2ku33qkwplojcrfj4v6tuennvzesx5lyetjqeltda._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
14ee2894b546ba6d7835ee4dd8e07ef72fb10bfaebec8f1687da4559267cb72e
Formbook
583dbdbb8f6be59c138dfb514d21b93fa1cd139a1184309ee3962ecaaa0be3b8
Formbook
5c7b804890877a7a9da085d878b0fc1a444aa1b75965e16beab74c978fab6079
Formbook
5d23faa05258eb51b196fee00263dc5e4556a37301d312563843a7ac8494ee19
Formbook
6a7659b4614c990d4feba15eeef035d47dcb8f46d92320620205eb6131eaf6a4
Formbook
805a071c8e38fca4e3602881ff33ac7a2afba65bb61cd7adda873950bf2779cb
Formbook
867ec49152a23a8e5ea628a48ec1810db588a716b922e6d1c8e7c45116908d24
Formbook
9e15ebbf48baef0f33c9ceb2e69566ec71d77271270a65dc5a7cf19a450f1a62
Formbook
c079b62cce0d0718c3b1f26c3f0f359a7df94acf7e75aea710979fe338ea1f4f
Formbook
e34426ec0d12a3acde221f2a5e5476528e028c1fc980a7c2d35dcfdde9caccab
Formbook
+ 3'526 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210119-mna8mgpb1a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.paniciagency.com/n6sn/
Unpacked files
SH256 hash:
3ec1b5fe04b14411979565292f4f4222c880afe28cabbf52a92a026eebb762f2
MD5 hash:
c1cba4ad6897f521b3ddd71f76376480
SHA1 hash:
8ecdc488664b965ec83a57a1f67074fd154d012f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/2d00bb98-bb33-4cc0-aef4-06ea828d02a8/
Parent samples :
5c7b804890877a7a9da085d878b0fc1a444aa1b75965e16beab74c978fab6079
e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6
SH256 hash:
52d35fabfc97d3e903b5d9eb253e8f84d1dfee2967fa9dde6d6ca37cc61951c5
MD5 hash:
b5a7f2596efe4c5fc5f5d2c733d49259
SHA1 hash:
c121578124375dc293e4daf12fac22442a8131b6
Link:
https://www.unpac.me/results/2d00bb98-bb33-4cc0-aef4-06ea828d02a8/
SH256 hash:
867197b89ac60838236381ec913e13fe950e0453187cd089abcff353da79d398
MD5 hash:
b43980540d37b9baa3e0111c9ee9184a
SHA1 hash:
272957661cd3dafc3704a79834eb444c8ceecf0c
Link:
https://www.unpac.me/results/2d00bb98-bb33-4cc0-aef4-06ea828d02a8/
SH256 hash:
e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6
MD5 hash:
f1195195c48e9e841b5405ef68ba4763
SHA1 hash:
67e7f7206f0fd88af81dec81bc07e19c78849272
Link:
https://www.unpac.me/results/2d00bb98-bb33-4cc0-aef4-06ea828d02a8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 0ab243bf4171b89fd4ba2c6324788e84975591354774cd23f5377a48e1d6ac51

Formbook

Executable exe e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6

(this sample)

  
Dropped by
MD5 66abe9eca06d7020489165f7c83c8c2a
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 0ab243bf4171b89fd4ba2c6324788e84975591354774cd23f5377a48e1d6ac51
Cape
Cape
https://www.capesandbox.com/analysis/112782/

Comments