MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 224ddfe0908d9cc2833a8f0f4c28f8a95ba1975cc0e8da5434a8ce17df54f972. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 224ddfe0908d9cc2833a8f0f4c28f8a95ba1975cc0e8da5434a8ce17df54f972
SHA3-384 hash: 48a56c6a477f14f6215aee9ff113b8b618c82a6eeda0567b587d6bd26ec87721e128b3d66dffc3f62a195136abd084b7
SHA1 hash: a748e77377f836d573a2162184999a423254e073
MD5 hash: c5f9cc2a279b42330a5e7790a137e53c
humanhash: beer-aspen-nebraska-finch
File name:RFQ_00701521.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:195'708 bytes
First seen:2021-07-15 12:16:43 UTC
Last seen:2021-07-15 12:40:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 3072:iBkfJpRXATwMdFCcGbLlFIDxtDGJtBXC/fbTI7wI2UJMTCIMonGsifby1urnnMdb:iqjIKYAtBmgwI2UsNYbSoMf5+0
Threatray 6'550 similar samples on MalwareBazaar
TLSH T1B914124D2A90DCB3D3960B701ABB5A462FFBC61A219113C3B750B7D93E37195642EA83
Reporter malwarelabnet
Tags:exe FormBook xloader

Intelligence

File Origin
# of uploads :
2
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ_00701521.exe
Verdict:
Malicious activity
Analysis date:
2021-07-15 12:19:59 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/54c6583c-ecdb-45b5-aa97-96f58e5c52b8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171978/
Detection(s):
SecuriteInfo.com.Trojan.Nsis.Spy.Gen.2.39.9522.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4da946b7-8e94-4d27-8ef6-6cca7cdab8b3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816887
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 449298 Sample: RFQ_00701521.exe Startdate: 15/07/2021 Architecture: WINDOWS Score: 100 33 www.coasttocoastballers.net 2->33 35 zhs.zohosites.com 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 6 other signatures 2->49 11 RFQ_00701521.exe 17 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\Local\Temp\xhriv.dll, PE32 11->31 dropped 59 Detected unpacking (changes PE section rights) 11->59 61 Maps a DLL or memory area into another process 11->61 63 Tries to detect virtualization through RDTSC time measurements 11->63 15 RFQ_00701521.exe 11->15         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 15->65 67 Maps a DLL or memory area into another process 15->67 69 Sample uses process hollowing technique 15->69 71 Queues an APC in another process (thread injection) 15->71 18 explorer.exe 15->18 injected process9 dnsIp10 37 rooms-id.email 162.0.229.111, 49771, 80 NAMECHEAP-NETUS Canada 18->37 39 www.orient-indonesia.com 107.165.116.92, 49774, 80 EGIHOSTINGUS United States 18->39 41 10 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 svchost.exe 18->22         started        25 autofmt.exe 18->25         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 27 cmd.exe 1 22->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/224ddfe0908d9cc2833a8f0f4c28f8a95ba1975cc0e8da5434a8ce17df54f972/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-15 03:05:42 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ejg57yeqrwomfaz2r4huykhyvfn2df24ydunuvbuvdhbpx2u7fza._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
07af0ffdb9e42eb6ca145708be323b7641311d943d28ba746d5f16dd4c5a3eed
Formbook
228f0e866b6580e0799a21147d9fbf4d6e56a5b89b9b68dcb29ca4d15d18f484
Formbook
34066150ffa7efa505b8d2246925cd8a32f83b9609438ae76aa27cef7388054d
Formbook
63b94415ccf2fabff3be3a811ded9a5306d68ac197adc07d7c2be3b313e8a665
Formbook
95eedb3eaf98ec12d5f66609278d43f94e1f635420d413ee0672bbf9434aafa4
Formbook
a65e94056f4196ac076a6cbd588bd094edb4f7dc9d9f5e1691817a4abc70be4b
Formbook
a6b7f7cc0b732bd64663fc8c69b3d88a155a2fbf6e0c0857435cb277d86e2e80
Formbook
a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570
Formbook
ab95bc3c40647b2b700cdb9aba76b6de220fd528fd194e6071c1747df6cb78ce
Formbook
f5a2547fc06aeb5416ee308668f2091e0e21c07b57aa6f4e5db47e06e6899a73
Formbook
+ 6'540 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210715-r23fdw7dmn/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.colwnpiece.club/eca0/
Unpacked files
SH256 hash:
51e996632264f3108bb89b9527909e9dc220f206e6a941e9aa251bead226a65d
MD5 hash:
d3d02687ef115d11dfb2ec82f1aedf8b
SHA1 hash:
b68dcc3af83dbe9ec6dc5725f640bc66ba0260cd
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/b150355a-0f14-4d7e-962d-c35cd24f444a/
Parent samples :
224ddfe0908d9cc2833a8f0f4c28f8a95ba1975cc0e8da5434a8ce17df54f972
4796e12d5a33b3b717b0ddc65286b9de7479e86bc91cc0bdb843722a5b62951b
SH256 hash:
caa656fcdd620c93fab04f5edc678234671dc29de4cfb486c1cdf714e483a5c2
MD5 hash:
212bd6076f307e5bc8d235af19ce33cb
SHA1 hash:
d91ac58a91a47e097fa3b8bf5764d5c4c87144af
Link:
https://www.unpac.me/results/b150355a-0f14-4d7e-962d-c35cd24f444a/
SH256 hash:
16d569d01211b87e4cefd1b707cad4417d58bd8b193e6e5685604df354aaad37
MD5 hash:
9879661182e3516296137988995aa352
SHA1 hash:
b161a4296aa199717c48dacfd36a423db25b6f13
Link:
https://www.unpac.me/results/b150355a-0f14-4d7e-962d-c35cd24f444a/
SH256 hash:
224ddfe0908d9cc2833a8f0f4c28f8a95ba1975cc0e8da5434a8ce17df54f972
MD5 hash:
c5f9cc2a279b42330a5e7790a137e53c
SHA1 hash:
a748e77377f836d573a2162184999a423254e073
Link:
https://www.unpac.me/results/b150355a-0f14-4d7e-962d-c35cd24f444a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/224ddfe0908d9cc2833a8f0f4c28f8a95ba1975cc0e8da5434a8ce17df54f972

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/171978/

Comments