MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10fc8f0ad0451656949f8b77a87815c2efd7524374685f4b261732183858aa18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10fc8f0ad0451656949f8b77a87815c2efd7524374685f4b261732183858aa18
SHA3-384 hash: 4ab755473543f4f8bf9160e3205a1d89bfadc606c5ca86218db4015c601fe4079e4536b26b105107ccd467a7bfa244f0
SHA1 hash: 78bc56b3cb96d8eb21875a36ab16ce60bb41efb1
MD5 hash: 83d920b7ab3b968a5ce1f2eec5090eec
humanhash: romeo-virginia-carolina-sixteen
File name:83d920b7ab3b968a5ce1f2eec5090eec
Download: download sample
Signature Formbook
Create hunting rule
File size:242'491 bytes
First seen:2022-04-12 13:16:09 UTC
Last seen:2022-04-12 14:00:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:8Qq+6aH8AQS6n7xk4LxR+I+RniH19ViyA9X:T6aH89S6vKrniHTVAJ
Threatray 14'900 similar samples on MalwareBazaar
TLSH T1FE34129872F1A077D61607B02B73DB36CB7AC2551E20A66793221FB52D31C87AB5930B
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
336
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Order 2 April 2022.xlsx
Verdict:
Malicious activity
Analysis date:
2022-04-12 12:09:56 UTC
Tags:
encrypted trojan opendir exploit CVE-2017-11882 loader formbook stealer
Link:
https://app.any.run/tasks/3fc4cfb8-7b2a-4c39-8a27-d9fec6f385e4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/263118/
Detection(s):
PUA.Win.Packer.NspackDotnetNor-2
Create hunting rule

PUA.Win.Packer.NspackDotnetNor-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Searching for synchronization primitives
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe formbook overlay packed shell32.dll virus
Link:
https://www.filescan.io/uploads/62557bd1eab80a7a6c00b27f/reports/f78e2a5b-ebb8-40e6-865c-0c283431b8a0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8bce9862-8181-497d-b310-6e34ad859bf4
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/975379
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 607870 Sample: M8eMQ9mvF0 Startdate: 12/04/2022 Architecture: WINDOWS Score: 100 34 www.agricolapuertolimon.com 2->34 36 www.crmpowerment.com 2->36 52 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->52 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 5 other signatures 2->58 12 M8eMQ9mvF0.exe 18 2->12         started        signatures3 process4 file5 32 C:\Users\user\AppData\Local\...\yrtuadv.exe, PE32 12->32 dropped 15 yrtuadv.exe 12->15         started        process6 signatures7 70 Tries to detect virtualization through RDTSC time measurements 15->70 18 yrtuadv.exe 15->18         started        process8 signatures9 44 Modifies the context of a thread in another process (thread injection) 18->44 46 Maps a DLL or memory area into another process 18->46 48 Sample uses process hollowing technique 18->48 50 Queues an APC in another process (thread injection) 18->50 21 explorer.exe 18->21 injected process10 dnsIp11 38 alkanlogistics.com 15.197.142.173, 49794, 80 TANDEMUS United States 21->38 40 www.encuentra.pro 207.244.67.218, 49791, 80 LEASEWEB-USA-WDCUS United States 21->40 42 2 other IPs or domains 21->42 60 System process connects to network (likely due to code injection or exploit) 21->60 62 Performs DNS queries to domains with low reputation 21->62 25 cmd.exe 21->25         started        signatures12 process13 signatures14 64 Modifies the context of a thread in another process (thread injection) 25->64 66 Maps a DLL or memory area into another process 25->66 68 Tries to detect virtualization through RDTSC time measurements 25->68 28 cmd.exe 1 25->28         started        process15 process16 30 conhost.exe 28->30         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/10fc8f0ad0451656949f8b77a87815c2efd7524374685f4b261732183858aa18/
Threat name:
Win32.Trojan.NSISInject
Create hunting rule
Status:
Malicious
First seen:
2022-04-12 13:17:06 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01222693e4698149f19d31ac66567a9815f89509bac13d690de8a5afda2bee08
Formbook
096bfb362ac98121211651cf9c8343ae3d38636334e626d89e7212660507ec7a
Formbook
28562d1e97597dbe302d550277e91bd4aa6869bd3d356668bc7c48b2b6eaa3d1
Formbook
2a4415721925c12ce8a80719697ffbda5daf88fe34804b0549bc5d5605790cdb
Formbook
41baa5cad8fb3ecbaa97116421042ba41a024823638e9b7608c5ac2e2a339525
Formbook
53685ac5f275b61fc580f2203e7d7e431d2b03b8e4320015b428745d68d5e333
Formbook
acf40f9d3eea74324291c55f5ab8d3678e0dcc085581bdd9cf66897f4324bc3c
Formbook
af985554eebc4990f77fc7c337d7af4367c2e28acbb41386669e5fa3bb55fbcd
Formbook
b1d74737f5430e16cb2ee4707ac986ba21fc2252d50315d2b4a77e4f278b1741
Formbook
+ 14'890 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:a0np loader rat
Link:
https://tria.ge/reports/220412-qjcprsegc5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
Xloader Payload
Xloader
Unpacked files
SH256 hash:
95299fb8d824bd6ff2cb1688daabdbb78993252faac151a0dad3832934c28691
MD5 hash:
83974bc7c1af55185007a4cfaad3327f
SHA1 hash:
9e7685748b04308e809545fcbab86ca37ca16472
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/226b8d50-24e8-41ab-9a83-ae7977c41adb/
Parent samples :
de7b53aa611115a5fd5ae91f3ad384b458e50e280c99e57b6c41ffd82a80b9e8
10fc8f0ad0451656949f8b77a87815c2efd7524374685f4b261732183858aa18
SH256 hash:
83be18c396f8a09f73187b147a1ad7e5f05e93b15a5e3e423d3c6b63d4f32fb0
MD5 hash:
5c51adb4ab22ae7852b3dbcc5ab4247c
SHA1 hash:
2b5b153a8f57ca2d187c82511686e57c308e6412
Link:
https://www.unpac.me/results/226b8d50-24e8-41ab-9a83-ae7977c41adb/
SH256 hash:
10fc8f0ad0451656949f8b77a87815c2efd7524374685f4b261732183858aa18
MD5 hash:
83d920b7ab3b968a5ce1f2eec5090eec
SHA1 hash:
78bc56b3cb96d8eb21875a36ab16ce60bb41efb1
Link:
https://www.unpac.me/results/226b8d50-24e8-41ab-9a83-ae7977c41adb/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/10fc8f0ad045/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10fc8f0ad0451656949f8b77a87815c2efd7524374685f4b261732183858aa18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_Formbook_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 10fc8f0ad0451656949f8b77a87815c2efd7524374685f4b261732183858aa18

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2142699/
Cape
Cape
https://www.capesandbox.com/analysis/263118/

Comments


Avatar
zbet commented on 2022-04-12 13:16:10 UTC

url : hxxp://107.172.76.210/709/vbc.exe