MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 253d9cf32609e691876a61247f172b54954d5b081c1c6b449bebccf5dac43c0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 253d9cf32609e691876a61247f172b54954d5b081c1c6b449bebccf5dac43c0b
SHA3-384 hash: 6e8955b32df04fa4d66e8c0f63bb0562582855af446815639891f042a89df69f54ef63be78115168244f3213183ec2f4
SHA1 hash: ad14c3583eeb5c8d3bd21ceb7b39e234e0817ded
MD5 hash: b30d4724d5ab3bc79ea20bf0cbd2aa39
humanhash: dakota-salami-one-hydrogen
File name:Roominglist.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:321'797 bytes
First seen:2021-08-11 08:53:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8c9e2729b91e6cd98523a27cc78ab06c (7 x AgentTesla, 5 x Formbook, 4 x Loki)
ssdeep 6144:W388JIphpMwAGjARMyE2BzKs6IDTUpCASMqzqgCWQN:j8JFZGjARxE2ksPgQv/+gtM
Threatray 7'636 similar samples on MalwareBazaar
TLSH T16364CE10B5C5AF71F83F4931046090695A3BFDB04E5A8FEF77985E6D3B741C02A22AA7
dhash icon 0c32b232d3c8c453 (49 x AgentTesla, 21 x Loki, 4 x Formbook)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
278
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Roominglist.exe
Verdict:
Malicious activity
Analysis date:
2021-08-11 08:56:24 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/1cecc794-c9fa-4c90-affd-3440855caf3f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/178160/
Detection(s):
Win.Trojan.Genkryptik-9884860-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Sending a UDP request
Launching a process
Launching cmd.exe command interpreter
DNS request
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/206a58b9-3c2a-48fc-adfc-c66aa4d2056c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/830752
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 463183 Sample: Roominglist.exe Startdate: 11/08/2021 Architecture: WINDOWS Score: 100 32 www.kinguest.com 2->32 34 prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com 2->34 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 4 other signatures 2->44 11 Roominglist.exe 2->11         started        signatures3 process4 signatures5 52 Detected unpacking (changes PE section rights) 11->52 54 Maps a DLL or memory area into another process 11->54 56 Tries to detect virtualization through RDTSC time measurements 11->56 14 Roominglist.exe 11->14         started        process6 signatures7 58 Modifies the context of a thread in another process (thread injection) 14->58 60 Maps a DLL or memory area into another process 14->60 62 Sample uses process hollowing technique 14->62 64 Queues an APC in another process (thread injection) 14->64 17 explorer.exe 14->17 injected process8 dnsIp9 28 www.sacramentohemorrhoidcenter.com 74.220.199.6, 49731, 80 UNIFIEDLAYER-AS-1US United States 17->28 30 www.zzinpick.com 17->30 36 System process connects to network (likely due to code injection or exploit) 17->36 21 msdt.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/253d9cf32609e691876a61247f172b54954d5b081c1c6b449bebccf5dac43c0b/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-08-09 07:52:16 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eu6zz4zgbhtjdb3kmesh6fzlksku2wyidqogwre35pgplwwehqfq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
027b78bee3eb51a23c82c4e77891d530cc1fad22adfa3f52b0ed8b37e9afc3b4
Formbook
0e4a21cb651986a7e2c71acdd7bf64079ce959417df8e214c073aba4ccfde44e
Formbook
5d1f28337792985c3609a213fa8895a307f35a529a22eafbad3281fa0f4e31a0
Formbook
6f699e2d98b52c522781d82018713d76762429a68bc236f5a155c275ba7b5268
Formbook
93fae9b54c0f1960139aa4007a0b8f695d61cdc5219fbfbe885c850a4f43a92d
Formbook
bdc84c917558fe1a4055309a8d6ad6d89d2cdf5a6741c218ace44f70489f9260
Formbook
df8b0772860e56938078f92e437d4c04ff34808f40837e249b85af1ffb4dee4b
Formbook
e8be28fabd7cdb2d4e96137dae73bd9b227a86b654c696e9fd401cb37ec68267
Formbook
f62f23f0f2a417ce32f3249502507a6036482bc41939eff23c92b1d5d44e480b
Formbook
f8ca257b6bbb8a0b617611a8ddb0068f056f3dc38eb525495978632b03964380
Formbook
+ 7'626 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ckvl rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/210811-b7e1vcrdf6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.verlan.guru/ckvl/
Unpacked files
SH256 hash:
4841df7d7b3e8dc721d3c54f4fe16bedc2ed099dcbd813807c089674b73f8596
MD5 hash:
d0376de9390f4cfecdff7a60bb5c5da0
SHA1 hash:
98b6d47b75957c111daa94c70edb901ee2e5ab96
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/517a77ea-ac64-4ea9-932a-97ae51f09003/
Parent samples :
253d9cf32609e691876a61247f172b54954d5b081c1c6b449bebccf5dac43c0b
20b597d93eb4d2b2bc15ff25aebb0d171918f99047c31f6eb728833967c8c37f
bd024645f51a267c6d24a75649cb617ac29029d5e9f8a3d8aa8c44b44cf668c9
02b2f3c02cfa488e665ff9e41233993dcfe8f2f02bf79536b1f9c88723ca7c32
25476caca5dd4eca6dea0616d2fdca485866cdd631abda0c410628d5cd9200b9
e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123
SH256 hash:
253d9cf32609e691876a61247f172b54954d5b081c1c6b449bebccf5dac43c0b
MD5 hash:
b30d4724d5ab3bc79ea20bf0cbd2aa39
SHA1 hash:
ad14c3583eeb5c8d3bd21ceb7b39e234e0817ded
Link:
https://www.unpac.me/results/517a77ea-ac64-4ea9-932a-97ae51f09003/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/253d9cf32609/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/253d9cf32609e691876a61247f172b54954d5b081c1c6b449bebccf5dac43c0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 253d9cf32609e691876a61247f172b54954d5b081c1c6b449bebccf5dac43c0b

(this sample)

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/178160/

Comments