MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2a0159fafd3bdbe6b457f8f724e142c8cfd9cb0eb02b508729cc7e3c42cf593. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2a0159fafd3bdbe6b457f8f724e142c8cfd9cb0eb02b508729cc7e3c42cf593
SHA3-384 hash: da90876db6921d37c33b63fc47ff7119246e79e33e816eeec05638b1e2d5b7d27999c0cb6b9fbed9f4e30210c4659f82
SHA1 hash: fdea869c122579b91b37eb9c30208645191375b1
MD5 hash: 909d921710d0a5bc4ddfacb0ced137bf
humanhash: oregon-ten-arkansas-fillet
File name:909d921710d0a5bc4ddfacb0ced137bf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:832'000 bytes
First seen:2022-09-19 08:21:04 UTC
Last seen:2022-09-19 08:58:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:9RWl0W42kA3TOGU2ybvNTjhFG8KBvqKT8B8IHhp2TBS:iw2kQ6GTaFGDBvBCLBpAS
TLSH T19905C0740369C90BC86E9874D8D2E3701EAB5DD6936FC60B88D83C67F73639478913A6
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f72e98b1b9dccecf (17 x AgentTesla, 16 x SnakeKeylogger, 3 x Formbook)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
invoice#2022091308##.docx
Verdict:
Malicious activity
Analysis date:
2022-09-19 07:02:50 UTC
Tags:
trojan opendir exploit CVE-2017-11882 loader formbook stealer
Link:
https://app.any.run/tasks/e4f2c75a-d5ff-4cb6-8a77-3e0ea4dba7b7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/311252/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.738.7244.4593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/632827324b785ddea2dbd38e/reports/af1d02af-264a-43f9-9c74-d20c1d14b219/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d2a77b16-125d-4b69-b76f-9f60845be41e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1072804
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 705348 Sample: 3Tzdu1mWoQ.exe Startdate: 19/09/2022 Architecture: WINDOWS Score: 100 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected AntiVM3 2->43 45 6 other signatures 2->45 10 3Tzdu1mWoQ.exe 3 2->10         started        process3 file4 29 C:\Users\user\AppData\...\3Tzdu1mWoQ.exe.log, ASCII 10->29 dropped 55 Tries to detect virtualization through RDTSC time measurements 10->55 57 Injects a PE file into a foreign processes 10->57 14 3Tzdu1mWoQ.exe 10->14         started        signatures5 process6 signatures7 59 Modifies the context of a thread in another process (thread injection) 14->59 61 Maps a DLL or memory area into another process 14->61 63 Sample uses process hollowing technique 14->63 65 Queues an APC in another process (thread injection) 14->65 17 explorer.exe 14->17 injected process8 dnsIp9 31 seobet.online 78.47.120.176, 49714, 49715, 80 HETZNER-ASDE Germany 17->31 33 www.seobet.online 17->33 47 System process connects to network (likely due to code injection or exploit) 17->47 21 WWAHost.exe 12 17->21         started        signatures10 process11 dnsIp12 35 www.seobet.online 21->35 37 seobet.online 21->37 49 Modifies the context of a thread in another process (thread injection) 21->49 51 Maps a DLL or memory area into another process 21->51 53 Tries to detect virtualization through RDTSC time measurements 21->53 25 cmd.exe 1 21->25         started        signatures13 process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f2a0159fafd3bdbe6b457f8f724e142c8cfd9cb0eb02b508729cc7e3c42cf593/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-09-19 06:30:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
21 of 25 (84.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kqblh5p2o63422fp6hxetqufsgp3hfq5mblkcdsttd6hrbm6wjq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:sde7 rat spyware stealer trojan
Link:
https://tria.ge/reports/220919-j82lvsgac5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook payload
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/441634b1-f653-44d9-8e44-a94b38ce4bf6
Unpacked files
SH256 hash:
dccfca6371f33fce0a17f34046e15d784ee179745c933c007a2c34d2dd3b201c
MD5 hash:
bb9c1f0ba47e5d9d20071ad2c310c6cf
SHA1 hash:
27b7434b6a48031729687558baf173d52c40b3c4
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/4f70e9b3-0dd0-4266-8930-d6a1cb7a2451/
Parent samples :
f2a0159fafd3bdbe6b457f8f724e142c8cfd9cb0eb02b508729cc7e3c42cf593
fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d
SH256 hash:
4395384ca66cd112b9fd986d69dca3adca1f2d07f18a2026c47d78394fea8ef7
MD5 hash:
760ed5fb4b854b3592b7ba2ae4585d55
SHA1 hash:
60e020611c0650af99f6253daa7851d96165fd5b
Link:
https://www.unpac.me/results/4f70e9b3-0dd0-4266-8930-d6a1cb7a2451/
SH256 hash:
44c50087cbd9a86677ff5b898c1ad52abf5f25297179a174edcc8b81dec967fc
MD5 hash:
d012ba9057bf67c7f29871326f2af919
SHA1 hash:
1d5b8b512b37f0e1900496b578117082929654c7
Link:
https://www.unpac.me/results/4f70e9b3-0dd0-4266-8930-d6a1cb7a2451/
SH256 hash:
b6c211a399fd10ad7281a10705f536609a8fd111e84a8c8e5aa7c3452bd49b07
MD5 hash:
82cc69ec7c9f04767ae4672d94a62ec0
SHA1 hash:
10cd13400b57329c23ea917c491775cb98ae6e17
Link:
https://www.unpac.me/results/4f70e9b3-0dd0-4266-8930-d6a1cb7a2451/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/4f70e9b3-0dd0-4266-8930-d6a1cb7a2451/
SH256 hash:
f2a0159fafd3bdbe6b457f8f724e142c8cfd9cb0eb02b508729cc7e3c42cf593
MD5 hash:
909d921710d0a5bc4ddfacb0ced137bf
SHA1 hash:
fdea869c122579b91b37eb9c30208645191375b1
Link:
https://www.unpac.me/results/4f70e9b3-0dd0-4266-8930-d6a1cb7a2451/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f2a0159fafd3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/f2a0159fafd3bdbe6b457f8f724e142c8cfd9cb0eb02b508729cc7e3c42cf593

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe f2a0159fafd3bdbe6b457f8f724e142c8cfd9cb0eb02b508729cc7e3c42cf593

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2307341/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/311252/

Comments