MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae
SHA3-384 hash: 8a882cbd7f0686a253cd549cdce2230cb82ef1ef4eccf9ec18ab3408dcbcc0b6c0a705529ed2e87f20f778ad564ba309
SHA1 hash: c745861fede33861fb7ecb4e74fec7ffc2f65838
MD5 hash: 89f2269c6b922334a760d393a84e14f5
humanhash: snake-steak-south-asparagus
File name:2021_50SG0BK00T1,pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'095'168 bytes
First seen:2021-01-19 07:55:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:3VM+ClKWSWXlyZDCLyDi7DiBbWz+r5fRoECo42Y1e0Lwcgn+dCa9WrbGR2J63j4k:KwzcyspgYUGwb+dt9WraRmuUg8SpsQ5
Threatray 3'536 similar samples on MalwareBazaar
TLSH B435AE0216987F58F2BE4B37C4A8485197FEFC11D752C92EADE439DE4E72B91A607203
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.olitec.cloud
Sending IP: 93.186.252.9
From: Selena Lei <info@ledluxor.com>
Subject: Offer Request / 2021_50SG0BK00T1
Attachment: 2021_50SG0BK00T1,pdf.iso (contains "2021_50SG0BK00T1,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2021_50SG0BK00T1,pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-01-19 08:04:14 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/8076ae7e-7958-4034-aa5b-5449dfb68d89

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/112827/
Result
Verdict:
Clean
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/584620
Signature
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses netstat to query active network connections and open ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 341343 Sample: 2021_50SG0BK00T1,pdf.exe Startdate: 19/01/2021 Architecture: WINDOWS Score: 100 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Sigma detected: Scheduled temp file as task from temp location 2->51 53 8 other signatures 2->53 10 2021_50SG0BK00T1,pdf.exe 7 2->10         started        process3 file4 33 C:\Users\user\AppData\...\uQbWwWGLjoOA.exe, PE32 10->33 dropped 35 C:\Users\...\uQbWwWGLjoOA.exe:Zone.Identifier, ASCII 10->35 dropped 37 C:\Users\user\AppData\Local\...\tmpD0CC.tmp, XML 10->37 dropped 39 C:\Users\...\2021_50SG0BK00T1,pdf.exe.log, ASCII 10->39 dropped 13 MSBuild.exe 10->13         started        16 MSBuild.exe 10->16         started        18 schtasks.exe 1 10->18         started        process5 signatures6 63 Modifies the context of a thread in another process (thread injection) 13->63 65 Maps a DLL or memory area into another process 13->65 67 Sample uses process hollowing technique 13->67 69 Queues an APC in another process (thread injection) 13->69 20 explorer.exe 13->20 injected 71 Tries to detect virtualization through RDTSC time measurements 16->71 24 conhost.exe 18->24         started        process7 dnsIp8 41 mwakossolutions.com 192.185.186.170, 49743, 80 UNIFIEDLAYER-AS-1US United States 20->41 43 carscompetition.com 37.97.254.27, 49747, 80 TRANSIP-ASAmsterdamtheNetherlandsNL Netherlands 20->43 45 10 other IPs or domains 20->45 55 System process connects to network (likely due to code injection or exploit) 20->55 26 NETSTAT.EXE 20->26         started        signatures9 process10 signatures11 57 Modifies the context of a thread in another process (thread injection) 26->57 59 Maps a DLL or memory area into another process 26->59 61 Tries to detect virtualization through RDTSC time measurements 26->61 29 cmd.exe 1 26->29         started        process12 process13 31 conhost.exe 29->31         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:56:07 UTC
AV detection:
10 of 44 (22.73%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=44ddzql6jk4fwcxji73dm32ksvlvruxd56a3wjdw655oyh3x3kxa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
04e7f27915298f09a1486331df3f0e5121e4a7856f41290f48200255b8b82df8
Formbook
14ee2894b546ba6d7835ee4dd8e07ef72fb10bfaebec8f1687da4559267cb72e
Formbook
20eb20f9b9fa4186e31943fb30235c77fd0816a5e6b6fc1ac2a9144b46672e3d
Formbook
2858bfcb9388b05049df45459ee60bf96be0b0d75a3be34cf3c00f57ec9f4469
Formbook
5c7b804890877a7a9da085d878b0fc1a444aa1b75965e16beab74c978fab6079
Formbook
73b51938efd53695a02c86e7bf50fac91203e43b5808758b2a698ef10475d264
Formbook
b4028a328ab3e533631461c92c11f0594dbc1311ccb259bfe7e37c325c31a1d5
Formbook
e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6
Formbook
f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c
Formbook
f53df4e1f9405d98a02cf34bedf2ee5df88437c130eb339eb6da9850f14ad443
Formbook
+ 3'526 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210119-hfcv7bdbz6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.radissonhotelsusa.com/cp5/
Unpacked files
SH256 hash:
5fb47a93e8f99354f497567e1f3e58ba78e76db73bd1415f2d7513ab89f29cb7
MD5 hash:
6f2f98ed322c76eba6ed310fee5c551e
SHA1 hash:
5ddc2d41bbcc90b734581178065b4784330a33c0
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/e782d9c6-e3ea-45ec-9215-4758862a4242/
Parent samples :
134447d4a42fa0c68719a166022b19728ab3b771a025fcb40b9e01eb0472bd8b
e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae
9bf3bb9e44490d5836c31036a78c59c92a51d8f6bfb33363d8c617d27967ff3f
SH256 hash:
52d35fabfc97d3e903b5d9eb253e8f84d1dfee2967fa9dde6d6ca37cc61951c5
MD5 hash:
b5a7f2596efe4c5fc5f5d2c733d49259
SHA1 hash:
c121578124375dc293e4daf12fac22442a8131b6
Link:
https://www.unpac.me/results/e782d9c6-e3ea-45ec-9215-4758862a4242/
SH256 hash:
fd94eb6ea20394ce070d400afa183000d7b9353348fe126c1a64acbef77312bf
MD5 hash:
48dbe1f1c0ff5dedb62c686932551fc7
SHA1 hash:
631037927e5af6ae613ff3f0c9e7eac7e0156fae
Link:
https://www.unpac.me/results/e782d9c6-e3ea-45ec-9215-4758862a4242/
SH256 hash:
e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae
MD5 hash:
89f2269c6b922334a760d393a84e14f5
SHA1 hash:
c745861fede33861fb7ecb4e74fec7ffc2f65838
Link:
https://www.unpac.me/results/e782d9c6-e3ea-45ec-9215-4758862a4242/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 57e475158ba52180b1bbb78829559826621790eb6f31bb01ae1217bf5d88294e

Formbook

Executable exe e7063cc17e4ab85b0ae947f6366f4a955758d2e3ef81bb2476f77aec1f77daae

(this sample)

  
Dropped by
MD5 8250bd62e0926faf78669c8742f42bdd
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 57e475158ba52180b1bbb78829559826621790eb6f31bb01ae1217bf5d88294e
Cape
Cape
https://www.capesandbox.com/analysis/112827/

Comments