MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827
SHA3-384 hash: 0dc6b92a45063552dcb791fb7cca514b0313cb530ded35444109f67ca14849e919bfa25570fa681d7333bba27349f22e
SHA1 hash: 725ac23500bde9d94f71ebdfb2e1486a9be9108d
MD5 hash: 0ad8631c3de13ef3867d5d887b6d2faa
humanhash: sweet-princess-hotel-rugby
File name:0mwSprBZ47mNQyY.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:680'960 bytes
First seen:2020-08-12 14:36:18 UTC
Last seen:2020-08-12 15:56:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:k1EFE2e2akCgK/z03+l03+2LweWxLf3rnUniDbGSZY3l6/4jiT:/FE2qkgz03+l03+2LLWxjbtmxVq4W
Threatray 5'438 similar samples on MalwareBazaar
TLSH 16E4C02433A59863E13A3E35CAB75514077BBC973939C70E5ADE73CE98303E949107AA
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: Hellandshamn <forbrukerkontakt@gjendemsjo.no>
Reply-To: forbrukerkontakt@gjendemsjo.no
Subject: FACTURA PROFORMA
Attachment: Proformainvoice.img (contains "0mwSprBZ47mNQyY.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/44195/
Detection(s):
SecuriteInfo.com.RSharedStrings.7859.8616.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Creating a file in the %AppData% subdirectories
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/422846
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Binary contains a suspicious time stamp
Detected FormBook malware
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 263869 Sample: 0mwSprBZ47mNQyY.exe Startdate: 13/08/2020 Architecture: WINDOWS Score: 100 27 www.songlyricssearchengine.online 2->27 29 www.lipbombed.com 2->29 31 www.candsmoguls.info 2->31 41 Malicious sample detected (through community Yara rule) 2->41 43 Yara detected AntiVM_3 2->43 45 Yara detected FormBook 2->45 47 5 other signatures 2->47 9 0mwSprBZ47mNQyY.exe 3 2->9         started        signatures3 process4 signatures5 57 Tries to detect virtualization through RDTSC time measurements 9->57 59 Injects a PE file into a foreign processes 9->59 12 0mwSprBZ47mNQyY.exe 9->12         started        process6 signatures7 61 Modifies the context of a thread in another process (thread injection) 12->61 63 Maps a DLL or memory area into another process 12->63 65 Queues an APC in another process (thread injection) 12->65 15 explorer.exe 12->15 injected process8 dnsIp9 33 www.regulars6.com 162.213.255.196, 49760, 49761, 49762 NAMECHEAP-NETUS United States 15->33 35 www.aryu.ltd 150.95.255.38, 49757, 49758, 49759 INTERQGMOInternetIncJP Japan 15->35 37 www.formations.house 35.177.62.177, 49754, 49755, 49756 AMAZON-02US United States 15->37 39 System process connects to network (likely due to code injection or exploit) 15->39 19 colorcpl.exe 17 15->19         started        signatures10 process11 file12 23 C:\Users\user\AppData\...\4KMlogrv.ini, data 19->23 dropped 25 C:\Users\user\AppData\...\4KMlogri.ini, data 19->25 dropped 49 Detected FormBook malware 19->49 51 Tries to steal Mail credentials (via file access) 19->51 53 Tries to harvest and steal browser information (history, passwords, etc) 19->53 55 3 other signatures 19->55 signatures13
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 14:38:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5j2ovrek34vrtqyqev4mwfhobti5kh26lyo2f62kwwynh57jdatq._file
Verdict:
malicious
Similar samples:
2351032596ba226e2ae00a4967cd8f85b158b5b2cfc1869d919bf5a2eea3c129
FormBook
7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6
FormBook
8a10ba003c94b5e6576d10a0c4bd01cabef6d87e4811e96c1a028e2cde63f414
FormBook
8e5e93b6f3eee7f1a08a0420b25105017d3479769e6bf9d6b2518d3abc6b1a75
FormBook
9c0d3c463792d704909de3a04cd7a6d31f8094301e8e24950af31cdc5e9f2838
FormBook
c9e605adb000dd5d2aa5dcd298c1b345d3ffec9d1db3adc40d18f149c4388bab
FormBook
d2b880fc3d1f874e31d23a37b38f75ceb1162c21ce895aec8dbec7f9c952f8f2
FormBook
d61447d5653bc8e81c91e487864e2ea56fe6700fa720e4b6b07040c9b50db868
FormBook
dcdd457e51bde64c24cf118ac54c8489efbc4bc55b5f1afc4facdfe673d3543e
FormBook
ec24550a9fa2fdb2a0e7c739b9ac97387925808dbd832b11675f18e48a93bcc5
FormBook
+ 5'428 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat spyware trojan stealer family:formbook
Link:
https://tria.ge/reports/200812-9hpcdz8xle/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.regulars6.com/zaer/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.89
Link:
https://yomi.yoroi.company/submissions/ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 86befa99292821348adb5b9e40528b2542472d9450348b1c61ebf04dda8268da

FormBook

Executable exe ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827

(this sample)

  
Dropped by
MD5 c1284b4bff017bb4407e2cd12769fb01
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/44195/
  
Dropped by
SHA256 86befa99292821348adb5b9e40528b2542472d9450348b1c61ebf04dda8268da

Comments