MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea
SHA3-384 hash: 0d174324ebdda48f9270dbc75c47240344a2bcf7a3a9f4f8d1f038e510ff451271bcb0c4d43d0e7f462769bd7cd3ea17
SHA1 hash: 4c1b1a2a6610c2f262c41112364e6629d11eb7f9
MD5 hash: a40d9c6f964664b6b5a3ec4ed532df6c
humanhash: carpet-happy-black-bulldog
File name:Rechnungszahlung.com
Download: download sample
Signature Formbook
Create hunting rule
File size:426'147 bytes
First seen:2021-10-11 17:17:47 UTC
Last seen:2021-10-11 17:44:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:b8LxBmfthdCKymIlPmoekhHPeFHG9zp6iON4xm7pgXu9CiCIN9X/:9dbyZhRRPeFm99A4g7pg6Dl7
Threatray 10'280 similar samples on MalwareBazaar
TLSH T19C94F106BB90CA63C02A57354CFBA7757734ED94AAA787077384BB1D2C733C59A022D9
File icon (PE):PE icon
dhash icon 600cc1e0fc385922 (1 x Formbook)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
278
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Rechnungszahlung.com
Verdict:
Malicious activity
Analysis date:
2021-10-11 17:26:13 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/d3491244-a640-41a4-8cd0-49adbe5eff11

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196699/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.1779.29924.24007.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/616471ccfd35fe780c387d50/reports/e9b53e7b-ff77-4852-bf02-ff549b5cac0e/overview
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1cbdacb6-9c4e-445f-ba3c-2104ad1e89bb
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/867753
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 500180 Sample: Rechnungszahlung.com Startdate: 11/10/2021 Architecture: WINDOWS Score: 100 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 7 other signatures 2->45 10 Rechnungszahlung.exe 17 2->10         started        process3 file4 29 C:\Users\user\AppData\Local\...\xztemc.dll, PE32 10->29 dropped 59 Detected unpacking (changes PE section rights) 10->59 61 Tries to detect virtualization through RDTSC time measurements 10->61 63 Injects a PE file into a foreign processes 10->63 14 Rechnungszahlung.exe 10->14         started        signatures5 process6 signatures7 65 Modifies the context of a thread in another process (thread injection) 14->65 67 Maps a DLL or memory area into another process 14->67 69 Sample uses process hollowing technique 14->69 71 Queues an APC in another process (thread injection) 14->71 17 explorer.exe 14->17 injected process8 dnsIp9 31 www.blwcd.com 103.47.80.234, 80 CHINANET-YUNNAN-IDC1CHINANETYunnanprovinceIDC1network China 17->31 33 www.thekinghealer.com 17->33 35 2 other IPs or domains 17->35 47 System process connects to network (likely due to code injection or exploit) 17->47 49 Uses ipconfig to lookup or modify the Windows network settings 17->49 21 ipconfig.exe 12 17->21         started        signatures10 process11 dnsIp12 37 www.blwcd.com 21->37 51 Self deletion via cmd delete 21->51 53 Modifies the context of a thread in another process (thread injection) 21->53 55 Maps a DLL or memory area into another process 21->55 57 Tries to detect virtualization through RDTSC time measurements 21->57 25 cmd.exe 1 21->25         started        signatures13 process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-10-11 12:18:48 UTC
AV detection:
22 of 43 (51.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fmktt3v3pscysubg3xgr4cygfqgzpa6zbr7ymi3pmt2cylunqhva._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2152a980e864940db36cde90c649f66e7c2da15790e97703a28cb378fb7b5ca6
Formbook
6d725aa4c3dd38bc7f924af4891b82a9c993e2db67765c72be42778a9c1b561a
Formbook
7c0ab1d837684e8d37e75578f4821e25d7729cb9d3739f397cabbb9c95f2ddae
Formbook
7c7e7d1ad3f8afd0ffcba163bac7c1df9ceb8202a96a61b30b697569e00051b0
Formbook
9e13a5c939cf22a9d4b60631d6c397903095561e51a9aaaca44be3666abf75e5
Formbook
cb1140dd7751382a2d56c59755a2ff38b239805148af2d108cf4f1399ca0f753
Formbook
d153e8b542963a9c9ae3fa96421f2ec2c5779759d0a086f3545b7e9c91074476
Formbook
d54e341578828a215bbe78db4f2dc64a5388d4ce3bc7d6488f7bafb8c6b02d1c
Formbook
+ 10'270 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:dn7r rat spyware stealer trojan
Link:
https://tria.ge/reports/211011-vt9vgahga5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.yourherogarden.net/dn7r/
Unpacked files
SH256 hash:
2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea
MD5 hash:
a40d9c6f964664b6b5a3ec4ed532df6c
SHA1 hash:
4c1b1a2a6610c2f262c41112364e6629d11eb7f9
Link:
https://www.unpac.me/results/12337b94-15e8-48ce-a0ce-f37c49d4c81a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea

(this sample)

  
Dropped by
formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/196699/

Comments