MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee3cd0b8ec089cdcec65b22189ecc9efb9f356afe0870e424cbdedcf19920e13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee3cd0b8ec089cdcec65b22189ecc9efb9f356afe0870e424cbdedcf19920e13
SHA3-384 hash: f0fcfacd58d1008e50fc80c61eeac8d45d73aa2cd48bbea52334aa1550c168f369e7e46a5da7b042e925c7f76e6ca6df
SHA1 hash: 44d9b01c74da9afceec097598112b6194b61ee56
MD5 hash: e5e76a789d667bf1a18f6fab81810bcb
humanhash: california-happy-neptune-finch
File name:prijenos SWIFT za partiju 220000000001182910.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:742'400 bytes
First seen:2021-06-29 09:55:06 UTC
Last seen:2021-06-29 10:46:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 297e933499a18450c85ffd54c53cbda8 (1 x RemcosRAT, 1 x Formbook, 1 x DBatLoader)
ssdeep 12288:8m4Hco5sy2ziQSM9CUl4kR5UM+iQDMYAdQUMjSiuPBR5lpbTYw+i:8jcPTS4CV6VQ/uQVSBRF
Threatray 6'198 similar samples on MalwareBazaar
TLSH C8F48E6199E1483BC0332E78DD0F5568642BFA411D782CC25BD99E84DF2E3663F3A4DA
Reporter TeamDreier
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
prijenos SWIFT za partiju 220000000001182910.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-29 10:04:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/066e5c8a-6752-48d2-a2ec-d388854e993c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168723/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d47ed91b-8685-4d85-895f-2ea27693f30a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/809272
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 441683 Sample: prijenos SWIFT za partiju 2... Startdate: 29/06/2021 Architecture: WINDOWS Score: 100 36 Found malware configuration 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 4 other signatures 2->42 10 prijenos SWIFT za partiju 220000000001182910.exe 17 2->10         started        process3 dnsIp4 34 cdn.discordapp.com 162.159.130.233, 443, 49712, 49713 CLOUDFLARENETUS United States 10->34 52 Writes to foreign memory regions 10->52 54 Allocates memory in foreign processes 10->54 56 Creates a thread in another existing process (thread injection) 10->56 58 Injects a PE file into a foreign processes 10->58 14 secinit.exe 10->14         started        signatures5 process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 14->60 62 Maps a DLL or memory area into another process 14->62 64 Sample uses process hollowing technique 14->64 66 2 other signatures 14->66 17 explorer.exe 14->17 injected process8 dnsIp9 28 www.extradeepsheets.com 192.155.168.111, 80 PING-GLOBAL-ASPingGlobalAmsterdamPOPASNNL United States 17->28 30 www.wazymbex.icu 17->30 32 2 other IPs or domains 17->32 44 System process connects to network (likely due to code injection or exploit) 17->44 21 help.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee3cd0b8ec089cdcec65b22189ecc9efb9f356afe0870e424cbdedcf19920e13/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2021-06-28 00:49:20 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5y6nbohmbconz3dfwiqyt3gj5647gvvp4cdq4qsmxxw46gmsbyjq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
28c834cf56663a83f9344840d232064cddf4fc6bab31178abaec6146a924f9f5
Formbook
3a6ec75b656e165939ee0d1f985678cb1799151e33449bba28c6a830ead01e3a
Formbook
8943af6c4da94f93c169ef98a7b8393ca92b01753e89ea5503d5740bcc45296d
Formbook
98f8f84dbf9e3a4462066c94e447ba3bdc6bc3d0119511e8c6d6cea0234f885c
Formbook
b8b841d90fe179b235744659d1bf9cd9860ff6d081b25ef0d485beefcf59e28a
Formbook
c288fba4b7716faf5562f4608d8ad0c1755ae059ba3d69569b60cf38a5f6f695
Formbook
c308169a026be95a659f89ea08e71093a5376b00b2e9a444d0659b1c4a2c2432
Formbook
caae480439293c7be6bb9ca27621f5b99c7391d6b7fddc179d5f5627c6144d08
Formbook
e355ac0da4996011e91f28b11e03c44d54606ae4ceb0bc4f6d0a0edc4b3410ed
Formbook
e3ccade6f4b9accc6cffa813b88862d68f78f0f1c601a57d0573e60deea6a370
Formbook
+ 6'188 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210629-4t483syvgs/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.kmresults.com/n7ak/
Unpacked files
SH256 hash:
fc2e68d5cf20e3f0bd18bb95bfac6e5e9e2f776c422394b743f2fc0be818c120
MD5 hash:
ee143f66c22c13a2bd87fc8490cc3de5
SHA1 hash:
743457daeb10809e06d7cf11e2d2dc48512c395f
Link:
https://www.unpac.me/results/3700d3ca-bef9-4c3a-95d3-1b916dd73393/
SH256 hash:
ee3cd0b8ec089cdcec65b22189ecc9efb9f356afe0870e424cbdedcf19920e13
MD5 hash:
e5e76a789d667bf1a18f6fab81810bcb
SHA1 hash:
44d9b01c74da9afceec097598112b6194b61ee56
Link:
https://www.unpac.me/results/3700d3ca-bef9-4c3a-95d3-1b916dd73393/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/ee3cd0b8ec089cdcec65b22189ecc9efb9f356afe0870e424cbdedcf19920e13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/168723/

Comments