MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc95c84eb428f263fef3220d512a2f602570f2acb41a46114244c30af48fd51b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc95c84eb428f263fef3220d512a2f602570f2acb41a46114244c30af48fd51b
SHA3-384 hash: e183fd0ee013b401f8672d19ae30d99c187150b8d31ae16fd0fcdf3086681462b963adb9edbe03f1d29fc2e36d22eeb8
SHA1 hash: 023204fd05667c7b5bf4d030a9af2dbc8e8f9105
MD5 hash: 5c411f4bc87a4883001c9801c098452e
humanhash: twelve-black-west-lion
File name:General Conditions of Purchase for none-engineered items.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:467'968 bytes
First seen:2020-07-27 06:22:15 UTC
Last seen:2020-07-27 06:32:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:qYFtNGfzRz3QYqk5OpsZm9EGph4V6614y1u:bGbRDQg5OSZsbw
Threatray 5'246 similar samples on MalwareBazaar
TLSH ABA4DF042540A79FC71789627427D8F0A613E0A6EB66DE335C8FD29B45C85FEB9C70A3
Reporter oppimaniac
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/32655/
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.3175.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/398260
Signature
Benign windows process drops PE files
Detected FormBook malware
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Steal Google chrome login data
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 251311 Sample: General Conditions of Purch... Startdate: 27/07/2020 Architecture: WINDOWS Score: 100 62 www.beykozevdenevenakliyatci.com 2->62 72 Malicious sample detected (through community Yara rule) 2->72 74 Multi AV Scanner detection for dropped file 2->74 76 Multi AV Scanner detection for submitted file 2->76 78 9 other signatures 2->78 11 General Conditions of Purchase for none-engineered items.exe 3 2->11         started        signatures3 process4 file5 54 General Conditions...eered items.exe.log, ASCII 11->54 dropped 14 General Conditions of Purchase for none-engineered items.exe 11->14         started        process6 signatures7 94 Modifies the context of a thread in another process (thread injection) 14->94 96 Maps a DLL or memory area into another process 14->96 98 Sample uses process hollowing technique 14->98 100 Queues an APC in another process (thread injection) 14->100 17 explorer.exe 1 6 14->17 injected process8 dnsIp9 56 www.patlod.com 63.250.47.235, 49712, 49713, 49714 NAMECHEAP-NETUS United States 17->56 58 lagharha.com 77.238.120.156, 49711, 80 ASIATECHIR Iran (ISLAMIC Republic Of) 17->58 60 www.lagharha.com 17->60 46 C:\Users\user\AppData\Local\...\ntimjvh.exe, PE32 17->46 dropped 80 System process connects to network (likely due to code injection or exploit) 17->80 82 Benign windows process drops PE files 17->82 22 msiexec.exe 1 19 17->22         started        26 ntimjvh.exe 3 17->26         started        28 cscript.exe 17->28         started        30 2 other processes 17->30 file10 signatures11 process12 file13 48 C:\Users\user\AppData\...4835logrv.ini, data 22->48 dropped 50 C:\Users\user\AppData\...5035logri.ini, data 22->50 dropped 52 C:\Users\user\AppData\...5235logrf.ini, data 22->52 dropped 84 Detected FormBook malware 22->84 86 Tries to steal Mail credentials (via file access) 22->86 88 Tries to harvest and steal browser information (history, passwords, etc) 22->88 92 2 other signatures 22->92 32 cmd.exe 2 22->32         started        36 cmd.exe 1 22->36         started        38 ntimjvh.exe 26->38         started        90 Tries to detect virtualization through RDTSC time measurements 28->90 signatures14 process15 file16 44 C:\Users\user\AppData\Local\Temp\DB1, SQLite 32->44 dropped 64 Tries to harvest and steal browser information (history, passwords, etc) 32->64 40 conhost.exe 32->40         started        42 conhost.exe 36->42         started        66 Modifies the context of a thread in another process (thread injection) 38->66 68 Maps a DLL or memory area into another process 38->68 70 Sample uses process hollowing technique 38->70 signatures17 process18
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fc95c84eb428f263fef3220d512a2f602570f2acb41a46114244c30af48fd51b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-27 06:24:07 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7sk4qtvufdzgh7xteigvckrpmasxb4vmwqnemekcitbqv5ep2unq._file
Verdict:
malicious
Similar samples:
00983a8176276beea115d21fef7919c49b29b96d78dbc2151cc04cc7d8c95b35
Formbook
0cd37496a09d3516103a2ba627f8c4bc9ba2eb99b0618d719a3fa9d708b9862d
Formbook
1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a
Formbook
3224b351afdfb9166bf37fde75a48e9d3212916a6584634600f90971ba3883ed
Formbook
4a21cad0d588267ebde8f8112e9d85bf355c77434beda6436cd9403a0a787c0d
Formbook
52e01cac4f5319a7d1177aae77861b4ad8f77b26581d089e948344d0e608b80b
Formbook
8697eb117ba4ca2b18a9a7bbdcbd201cc062e2e79ccbc9d8ea785baf5b868657
Formbook
a6009a6b0724811f3bb71fc6f0c6b3b1aad71448948175949c7eb8af82034e91
Formbook
bd3afdd3cda53eebbebcc99b946ff7eb2f972fcf1c5a3a11ffcf633a46f1b853
Formbook
cc84debcfc3e30a4b682bb53e028acb0a75d56607ab25b2418797f65a7e6efb7
Formbook
+ 5'236 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200727-rjakzp8m7e/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Suspicious use of SetThreadContext
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc95c84eb428f263fef3220d512a2f602570f2acb41a46114244c30af48fd51b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32655/

Comments