MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d0a72e23a95a6e537d344e6acab903e09793a4b652cad815daf9b8bab23b47f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d0a72e23a95a6e537d344e6acab903e09793a4b652cad815daf9b8bab23b47f
SHA3-384 hash: 20f1ca44f0c883fa35f12bcc3b5454f76d2e65214106d217438f96722d7d08e89b1d940a90f803de3d8a085374ad3783
SHA1 hash: 03c38c12aae3d1af5a57375a5c3146a5b9d02cd3
MD5 hash: 1a71e3af2781373a5a75ff0ab0903ff1
humanhash: lithium-violet-indigo-october
File name:1a71e3af2781373a5a75ff0ab0903ff1.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:256'888 bytes
First seen:2022-02-01 08:26:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:owBcjsvfhCjhYvWKUnBGIXE+RdWOaYLCHNv5tcGva7UXV:hGWViTTR+YehXva7IV
Threatray 13'255 similar samples on MalwareBazaar
TLSH T1D644124536C0C497DE0647322A7FA3B2E7BAF7251E70251357910FA725B2083696E3AF
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
W6903.xlsx
Verdict:
Malicious activity
Analysis date:
2022-02-01 06:45:57 UTC
Tags:
encrypted exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/3d1e5701-3c34-4a30-b149-a736a75a181c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/229095/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61f8eed86d25ac9e79f45cde/reports/2b4eddc7-2717-47b3-83cc-3ee17055b5c2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RaRansomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bea55875-09e9-41e6-90ca-25e935ec339b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/931436
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 563915 Sample: 8XLeuvWT3Q.exe Startdate: 01/02/2022 Architecture: WINDOWS Score: 100 33 www.youngliving1.com 2->33 35 www.tipslowclever.rest 2->35 37 7 other IPs or domains 2->37 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 6 other signatures 2->53 11 8XLeuvWT3Q.exe 19 2->11         started        15 explorer.exe 43 2->15         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\lftegtgims.dll, PE32 11->31 dropped 63 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 11->63 65 Tries to detect virtualization through RDTSC time measurements 11->65 67 Injects a PE file into a foreign processes 11->67 17 8XLeuvWT3Q.exe 11->17         started        signatures6 process7 signatures8 39 Modifies the context of a thread in another process (thread injection) 17->39 41 Maps a DLL or memory area into another process 17->41 43 Sample uses process hollowing technique 17->43 45 Queues an APC in another process (thread injection) 17->45 20 explorer.exe 17->20 injected process9 process10 22 mstsc.exe 20->22         started        signatures11 55 Self deletion via cmd delete 22->55 57 Modifies the context of a thread in another process (thread injection) 22->57 59 Maps a DLL or memory area into another process 22->59 61 Tries to detect virtualization through RDTSC time measurements 22->61 25 cmd.exe 1 22->25         started        27 explorer.exe 117 22->27         started        process12 process13 29 conhost.exe 25->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d0a72e23a95a6e537d344e6acab903e09793a4b652cad815daf9b8bab23b47f/
Threat name:
Win32.Trojan.Risis
Create hunting rule
Status:
Malicious
First seen:
2022-02-01 08:27:09 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
18 of 39 (46.15%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02c848711be5356cc435b98837bdf0120cac86fdeaa5238793a3ab6300482147
Formbook
08d17b9c0d3ab4eb79a38b0a500655f9f47bc3468718ae5b61d59d0b2b687e53
Formbook
0da36b7f7e4b44b640ab5769532fdd7599032ca2b1d6b57807ba48ad1fa76780
Formbook
194eecb866b404241cc14abfccf3ece512927dafff1e64248e1b1fb4e4acbd26
Formbook
1ec8f5c2a626d9484af9532ed48a5b7482fc0dcdab074d8545ac8e4454c68a89
Formbook
2a4415721925c12ce8a80719697ffbda5daf88fe34804b0549bc5d5605790cdb
Formbook
75362f20dab8d57db3ade6427e647b0bc01d8345ccfa9781d5778877f04f7fb5
Formbook
75e51d5e7662ad2c7ee23822ebf5246ce2d3257734ef87883f57bbcffe13c5d2
Formbook
9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e
Formbook
fc35540b602ba860b10c2b43261657a7e2b9fc1d3aa8104272f2255a664fabd7
Formbook
+ 13'245 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
daa0dc3ecff8ff5f914daa028ca77c7d78680249975f526a48d6c4b68e9efda6
MD5 hash:
7bbf3ff766e8e224100b19854caf2e62
SHA1 hash:
b48f9d6939d73d0e33a695ef40d5923aa9d3277c
Link:
https://www.unpac.me/results/70094009-b49c-48dd-b517-1c85deea1c57/
SH256 hash:
0d0a72e23a95a6e537d344e6acab903e09793a4b652cad815daf9b8bab23b47f
MD5 hash:
1a71e3af2781373a5a75ff0ab0903ff1
SHA1 hash:
03c38c12aae3d1af5a57375a5c3146a5b9d02cd3
Link:
https://www.unpac.me/results/70094009-b49c-48dd-b517-1c85deea1c57/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0d0a72e23a95/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.43
Link:
https://yomi.yoroi.company/submissions/0d0a72e23a95a6e537d344e6acab903e09793a4b652cad815daf9b8bab23b47f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 0d0a72e23a95a6e537d344e6acab903e09793a4b652cad815daf9b8bab23b47f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2001965/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/229095/

Comments