MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efb235d07bd3577e3194559ee6d3d3102cba19a590fb05ae65f45a617b5a03d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	efb235d07bd3577e3194559ee6d3d3102cba19a590fb05ae65f45a617b5a03d3
SHA3-384 hash:	0c2bdf392a8ffa2ff8b193a1de2d5118af1c116f11f9202c35c91e587ac0af018f328bd39363eb3364b73858753b2245
SHA1 hash:	4ac8de4b7ba3de3df28b83f49d5bb40dc5323843
MD5 hash:	6126f03115798d583845ce085f04bc3c
humanhash:	echo-neptune-vegan-hawaii
File name:	New Order list..exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'561'088 bytes
First seen:	2020-10-15 13:01:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep	24576:IAHnh+eWsN3skA4RV1Hom2KXMmHanWmasqlzZZo/+4W4heaRNDhr5:Ph+ZkldoPK8YaWtLZaLhPRN/
Threatray	813 similar samples on MalwareBazaar
TLSH	8E75AE026794E1AFFE9663734E17EA406179A8A04422772EA3DC1FECE87C47D713E152
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing unidentified malware:

HELO: vrmin.techstores.gr
Sending IP: 95.129.46.103
From: Rafik Beshay <rafik.beshay@beshaysteel.com>
Subject: Re: Re: About New Order
Attachment: New Order list..zip (contains "New Order list..exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/71406/

Detection(s):

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL

SecuriteInfo.com.AutoIT-3.UNOFFICIAL

SecuriteInfo.com.JS.EmbeddedEXE-5.UNOFFICIAL

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Creating a file

Unauthorized injection to a recently created process

Launching a process

Launching cmd.exe command interpreter

Setting browser functions hooks

Enabling autorun by creating a file

Unauthorized injection to a system process

Unauthorized injection to a browser process

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/492487

Signature

AutoIt script contains suspicious strings

Binary is likely a compiled AutoIt script file

Initial sample is a PE file and has a suspicious name

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: Drops script at startup location

Tries to detect virtualization through RDTSC time measurements

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/efb235d07bd3577e3194559ee6d3d3102cba19a590fb05ae65f45a617b5a03d3/

Threat name:

Win32.Trojan.Predator

Status:

Malicious

First seen:

2020-10-15 08:23:20 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=56zdlud32nlx4mmukwponu6tcawlugnfsd5qlltf6rngc622apjq._file

Verdict:

unknown

Result

Malware family:

formbook

Score:

10/10

Tags:

rat trojan spyware stealer family:formbook persistence

Link:

https://tria.ge/reports/201015-9l8b4bzvqn/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Suspicious use of SetThreadContext

Adds Run key to start application

Deletes itself

Drops startup file

Reads user/profile data of web browsers

Adds policy Run key to start application

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.joomlas123.info/3nop/

Unpacked files

SH256 hash:

efb235d07bd3577e3194559ee6d3d3102cba19a590fb05ae65f45a617b5a03d3

MD5 hash:

6126f03115798d583845ce085f04bc3c

SHA1 hash:

4ac8de4b7ba3de3df28b83f49d5bb40dc5323843

Link:

https://www.unpac.me/results/1117f951-a3a9-4612-b198-d6fe3ebb6cd0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/efb235d07bd3577e3194559ee6d3d3102cba19a590fb05ae65f45a617b5a03d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.