MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0865d67549d3eb5410be06ae04c3f0a2a9090dacc186f6a5b3f3443547aa88a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0865d67549d3eb5410be06ae04c3f0a2a9090dacc186f6a5b3f3443547aa88a0
SHA3-384 hash: dabf6f090c6c2cfccaecca259147078156f9f6674bd864d8c8dd73f9f11f629cffd7dcc29058f847a24247e07ebfb8ca
SHA1 hash: 6f054583aeea17fe5502dad0c26d08bd7c2de674
MD5 hash: aa3e504f6717283bc481f0accdb5273f
humanhash: venus-moon-beryllium-white
File name:890927362736.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'149'952 bytes
First seen:2024-10-17 08:10:22 UTC
Last seen:2024-10-17 08:39:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 287697fb6c74cb09edf9d5bdfc14fc02 (2 x DBatLoader, 1 x Formbook)
ssdeep 24576:N2OtoLoUP/84vFFiNno90XzSz4FMzDVW1SKCDH7:No3dbmjSmM3UxAH7
TLSH T192356A15E3C24E35DC32273B280EB2DD27082D60571CAB65E6B5BB6C6A347E32DF5162
TrID 38.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
28.2% (.EXE) Win64 Executable (generic) (10522/11/4)
12.0% (.EXE) Win32 Executable (generic) (4504/4/1)
5.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
5.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon 33d0d8f6d4d8f033 (2 x DBatLoader, 1 x Formbook)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
376
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
890927362736.exe
Verdict:
No threats detected
Analysis date:
2024-10-17 10:32:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cfd45bd9-22a7-49ca-8d7f-9f802572b688

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.29302.4802.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6710c69e707bcd8537fc2699
Tags:
Delphi Emotet
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
borland_delphi fingerprint keylogger packed
Link:
https://www.filescan.io/uploads/6710c69d3a92cf04fca05742/reports/a12108a0-79a8-4cdb-b887-6d59de256fc0/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0865d67549d3eb5410be06ae04c3f0a2a9090dacc186f6a5b3f3443547aa88a0
Result
Verdict:
MALICIOUS
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e19a3b05-1e84-4497-b5a3-526dfa76f75f
Result
Threat name:
DBatLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1535814
Signature
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1535814 Sample: 890927362736.exe Startdate: 17/10/2024 Architecture: WINDOWS Score: 100 29 www.nibcorp.xyz 2->29 31 www.joshcharlesfitness.xyz 2->31 33 24 other IPs or domains 2->33 49 Suricata IDS alerts for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 57 6 other signatures 2->57 10 890927362736.exe 2->10         started        signatures3 55 Performs DNS queries to domains with low reputation 31->55 process4 dnsIp5 41 bitbucket.org 185.166.143.50, 443, 49704, 49705 AMAZON-02US Germany 10->41 43 s3-w.us-east-1.amazonaws.com 3.5.25.173, 443, 49706, 49709 AMAZON-AESUS United States 10->43 45 52.217.94.212, 443, 49712 AMAZON-02US United States 10->45 69 Writes to foreign memory regions 10->69 71 Allocates memory in foreign processes 10->71 73 Creates a thread in another existing process (thread injection) 10->73 75 2 other signatures 10->75 14 colorcpl.exe 2 10->14         started        signatures6 process7 signatures8 77 Maps a DLL or memory area into another process 14->77 17 qdrzYbcFTOp.exe 14->17 injected process9 signatures10 47 Found direct / indirect Syscall (likely to bypass EDR) 17->47 20 takeown.exe 13 17->20         started        process11 signatures12 59 Tries to steal Mail credentials (via file / registry access) 20->59 61 Tries to harvest and steal browser information (history, passwords, etc) 20->61 63 Modifies the context of a thread in another process (thread injection) 20->63 65 3 other signatures 20->65 23 qdrzYbcFTOp.exe 20->23 injected 27 firefox.exe 20->27         started        process13 dnsIp14 35 www.g4s7e5.biz 203.90.227.88, 50009, 50010, 50011 UDOMAIN-AS-APUDomainWebHostingCompanyLtdHK Hong Kong 23->35 37 www.fruugocn.shop 150.109.150.125, 50025, 50026, 50027 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN Singapore 23->37 39 10 other IPs or domains 23->39 67 Found direct / indirect Syscall (likely to bypass EDR) 23->67 signatures15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0865d67549d3eb5410be06ae04c3f0a2a9090dacc186f6a5b3f3443547aa88a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0865d67549d3eb5410be06ae04c3f0a2a9090dacc186f6a5b3f3443547aa88a0/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-10-16 08:45:22 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbs5m5kj2pvvief6a2xajq7qukuqsdnmygdpnjnt6ncdkr5krcqa._file
Verdict:
malicious
Label(s):
dbatloader
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery
Link:
https://tria.ge/reports/241017-j3a7qayhjd/
Behaviour
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Legitimate hosting services abused for malware hosting/C2
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fabe66ab-aec4-46e8-8482-3d2de2c44108
Unpacked files
SH256 hash:
fa3b1d49ef4b887fabe828b17bf2ca1f8b33fa9078ee9f1931f557a14ba18481
MD5 hash:
55621a19fe9a41c1ee3393cc028f36da
SHA1 hash:
f98d364a4d4d4ff02a3725cfd564afbeb0692adf
Detections:
Typical_Malware_String_Transforms
Create hunting rule
Link:
https://www.unpac.me/results/41881d4e-e4f2-407a-8ce5-e74bb4c32a61/
SH256 hash:
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 hash:
c116d3604ceafe7057d77ff27552c215
SHA1 hash:
452b14432fb5758b46f2897aeccd89f7c82a727d
Link:
https://www.unpac.me/results/41881d4e-e4f2-407a-8ce5-e74bb4c32a61/
SH256 hash:
0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
MD5 hash:
869640d0a3f838694ab4dfea9e2f544d
SHA1 hash:
bdc42b280446ba53624ff23f314aadb861566832
Link:
https://www.unpac.me/results/41881d4e-e4f2-407a-8ce5-e74bb4c32a61/
SH256 hash:
0865d67549d3eb5410be06ae04c3f0a2a9090dacc186f6a5b3f3443547aa88a0
MD5 hash:
aa3e504f6717283bc481f0accdb5273f
SHA1 hash:
6f054583aeea17fe5502dad0c26d08bd7c2de674
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/41881d4e-e4f2-407a-8ce5-e74bb4c32a61/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/0865d67549d3eb5410be06ae04c3f0a2a9090dacc186f6a5b3f3443547aa88a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::GetFileAttributesA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::PeekMessageW
user32.dll::CreateWindowExA

Comments