MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 210d5b19dfc3dff919ba6ed4d76d2aa8becc988dabcca66b247d05c51811434b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 19

Intelligence 19 IOCs YARA 1 File information Comments

SHA256 hash:	210d5b19dfc3dff919ba6ed4d76d2aa8becc988dabcca66b247d05c51811434b
SHA3-384 hash:	fc9f85065f76f6318f19bebb5e7cb03ea049147d0f933cc0cf4fe8a1a4467baa934846989dd01074be3fd042c46bf971
SHA1 hash:	bc96f51d24069d9b8364121dc4397c88e08cb309
MD5 hash:	420a0137eaa22be40636008e05d8005a
humanhash:	glucose-carolina-sodium-neptune
File name:	ibm_Centos.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	354'676 bytes
First seen:	2023-07-05 13:35:42 UTC
Last seen:	2023-07-05 16:04:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 429 x GuLoader)
ssdeep	6144:vYa6rL0Yr8jMUoy49G6SCP/3S19UvOlJJOa85BE681q6pvojLjVY:vYZDJyDm/3SRJwvBEz7p6tY
Threatray	3'381 similar samples on MalwareBazaar
TLSH	T1C174124573B4F873D5A501B54A33072AAFFBE41114749A8B57B08AECBD0BA60CE1EB52
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	Anonymous
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

296

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

SOA202370511.xls

Verdict:

Malicious activity

Analysis date:

2023-07-05 13:22:28 UTC

Tags:

exploit cve-2017-11882 opendir loader formbook xloader

Link:

https://app.any.run/tasks/1a2a8219-2386-4510-9cca-3f7e7cbc1463

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/407747/

Detection(s):

SecuriteInfo.com.Variant.Jaik.154063.1077.18568.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Creating a file in the %AppData% subdirectories

Unauthorized injection to a recently created process

Restart of the analyzed sample

Launching a process

Сreating synchronization primitives

Launching cmd.exe command interpreter

Setting browser functions hooks

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a system process

Unauthorized injection to a browser process

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/95645/overview

Behaviour

MalwareBazaar

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/64a571c51aae5c95e186bbb1/reports/42caba41-d6d6-46c4-b18c-1636de39509e/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/210d5b19dfc3dff919ba6ed4d76d2aa8becc988dabcca66b247d05c51811434b

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a06fc39f-11bc-4528-bf58-a08ec2c906dc

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1267379

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect virtualization through RDTSC time measurements

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/210d5b19dfc3dff919ba6ed4d76d2aa8becc988dabcca66b247d05c51811434b/

Threat name:

Win32.Trojan.FormBook

Status:

Malicious

First seen:

2023-07-05 13:36:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eegvwgo7ypp7sgn2n3kno3jkvc7mzgenvpgkm2zepuc4kgarinfq._file

Verdict:

malicious

Label(s):

formbook

Formbook

43b5cfd70c439d116d7ec6381d664d5c8e7f89f84eb4186675db11bf830ebabb

Formbook

53bb0f293733cadbf6b5704cd0359b61acaa6367eb49268905714492d35ddf81

Formbook

597979053a51f37ffa0cbeb1847f707b2dd3b3cdbcc5c0a5e66a1f15b5419b8e

Formbook

68ba26474bb29bdbc42cfddd75f212eec1ffa22d5c1affc893addce5330f4e11

Formbook

87f7348a8731af0346cfcc709488d0831a95236f554d2f8a50e12eea1ceb6764

Formbook

9b11fa3cfa0acdd01be3595fba22f7b38c333e7ec8da88228c971735913bb6f7

Formbook

bedb5ef007caf41eb52f0331f1fdf5997271a828df7adb1e1132063129eba99e

Formbook

c104d364eec79cad7a9c9040ff30d46e6b2bf694b3c8f80130bb599345fc3d76

Formbook

f79a020cedb43bbd1f4948a2566d081fed934d56f871741d2548f792e8800e7b

Formbook

+ 3'371 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:m42i persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/230705-qv8xcacf82/

Behaviour

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Deletes itself

Loads dropped DLL

Formbook payload

Formbook

Unpacked files

SH256 hash:

6a6d1e38d6cf19d9e006fa09b9d4ad1ae6dea89f72dc5a0bf74f9cadac6fc69e

MD5 hash:

1a3a42eb12c818f6466c5be494618123

SHA1 hash:

0573135d01872f45c9532887d9fa702f752590f1

Detections:

FormBook

win_formbook_w0

win_formbook_auto

win_formbook_g0

FormBook

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/ac8af74d-6e67-4c5b-87b6-7f3effcb5101/

Parent samples :

87f7348a8731af0346cfcc709488d0831a95236f554d2f8a50e12eea1ceb6764
68ba26474bb29bdbc42cfddd75f212eec1ffa22d5c1affc893addce5330f4e11
53bb0f293733cadbf6b5704cd0359b61acaa6367eb49268905714492d35ddf81
02ffa3a8856091ec637bfe8f4155eb49d3ede06df0cf2e83b828f5b27c983627
210d5b19dfc3dff919ba6ed4d76d2aa8becc988dabcca66b247d05c51811434b

SH256 hash:

39cd81d25e703846eb67234b19357736b57f2f4a0f1c4b802f9d0db2c99b3456

MD5 hash:

4874e9c95597c552811c664d489739c0

SHA1 hash:

109145d468e60a9c1d3b9dbfffbf798bfa4e8e95

Link:

https://www.unpac.me/results/ac8af74d-6e67-4c5b-87b6-7f3effcb5101/

SH256 hash:

6a6d1e38d6cf19d9e006fa09b9d4ad1ae6dea89f72dc5a0bf74f9cadac6fc69e

MD5 hash:

1a3a42eb12c818f6466c5be494618123

SHA1 hash:

0573135d01872f45c9532887d9fa702f752590f1

Detections:

FormBook

win_formbook_w0

win_formbook_auto

win_formbook_g0

FormBook

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/ac8af74d-6e67-4c5b-87b6-7f3effcb5101/

Parent samples :

SH256 hash:

39cd81d25e703846eb67234b19357736b57f2f4a0f1c4b802f9d0db2c99b3456

MD5 hash:

4874e9c95597c552811c664d489739c0

SHA1 hash:

109145d468e60a9c1d3b9dbfffbf798bfa4e8e95

Link:

https://www.unpac.me/results/ac8af74d-6e67-4c5b-87b6-7f3effcb5101/

SH256 hash:

210d5b19dfc3dff919ba6ed4d76d2aa8becc988dabcca66b247d05c51811434b

MD5 hash:

420a0137eaa22be40636008e05d8005a

SHA1 hash:

bc96f51d24069d9b8364121dc4397c88e08cb309

Link:

https://www.unpac.me/results/ac8af74d-6e67-4c5b-87b6-7f3effcb5101/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/210d5b19dfc3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/210d5b19dfc3dff919ba6ed4d76d2aa8becc988dabcca66b247d05c51811434b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.