MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f
SHA3-384 hash: 29bc011ff88a51fd5bea8d5c8b06655b0e3c9d9c089c3dc09dea18588763e2aae1070cc40733cb3f0281cab93cd79bc7
SHA1 hash: ad494f6c6d34232ed4126895daa650e7967e4f09
MD5 hash: ccc2490450e1a7874b0afe7a6750a277
humanhash: nine-pasta-july-montana
File name:DHL OVERDUE INVOICES.scr
Download: download sample
Signature Formbook
Create hunting rule
File size:422'445 bytes
First seen:2022-01-26 14:25:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:NwW3I/rWDFjcBRTTr41wxnvDyrJEdscKL895CCgyb3fvoeFg6z4mT0A:L3IrWDMTr0wxvDRK49MG3fvoeuwdIA
TLSH T15494BFF23D5C41D5F86F1271BA1EA86626E17C2FEAE0340A515FF41BC5F231602AE61B
File icon (PE):PE icon
dhash icon 0f696a86630786cd (3 x Formbook)
Reporter abuse_ch
Tags:DHL exe FormBook scr

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/223342/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Сreating synchronization primitives
DNS request
Launching the process to change network settings
Launching cmd.exe command interpreter
Searching for synchronization primitives
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61f15a00d73ca9d4648dabbb/reports/b819c0ed-fc3e-499d-9170-45aba6bcbb17/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0df61352-35af-4c5d-813f-9574e3240d4e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/928418
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Executable has a suspicious name (potential lure to open the executable)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 560896 Sample: DHL OVERDUE INVOICES.scr Startdate: 27/01/2022 Architecture: WINDOWS Score: 100 35 www.ghpgroupinc.xyz 2->35 37 www.boreslirealestate.com 2->37 39 2 other IPs or domains 2->39 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for URL or domain 2->53 55 10 other signatures 2->55 11 DHL OVERDUE INVOICES.exe 19 2->11         started        15 explorer.exe 10 2->15         started        signatures3 process4 file5 33 C:\Users\user\AppData\Local\...\jfldbwomu.dll, PE32 11->33 dropped 65 Injects a PE file into a foreign processes 11->65 17 DHL OVERDUE INVOICES.exe 11->17         started        signatures6 process7 signatures8 41 Modifies the context of a thread in another process (thread injection) 17->41 43 Maps a DLL or memory area into another process 17->43 45 Sample uses process hollowing technique 17->45 47 Queues an APC in another process (thread injection) 17->47 20 explorer.exe 17->20 injected process9 process10 22 wlanext.exe 20->22         started        25 autofmt.exe 20->25         started        signatures11 57 Self deletion via cmd delete 22->57 59 Modifies the context of a thread in another process (thread injection) 22->59 61 Maps a DLL or memory area into another process 22->61 63 Tries to detect virtualization through RDTSC time measurements 22->63 27 cmd.exe 1 22->27         started        29 explorer.exe 1 148 22->29         started        process12 process13 31 conhost.exe 27->31         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f/
Threat name:
Win32.Trojan.Nemesis
Create hunting rule
Status:
Malicious
First seen:
2022-01-26 14:26:13 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
15 of 42 (35.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f25d7hmckwnob6grlqkb2ocevu5oj2mmpbvlm4qfa2vt5acwlwhq._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:quc5 loader rat suricata
Link:
https://tria.ge/reports/220126-rr1x1adgcj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
2016760276966e7d0a1b3ce5eb62661ee8e92f66e5c04da23d3862c7c2e463f2
MD5 hash:
2cb4c00b5b6341dba4b67aa976efbbd2
SHA1 hash:
0d35ccfebfa45994f925c133ef0477cb33619a24
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/81f2b794-d17c-425c-bb38-9d4460281c89/
Parent samples :
088cc7491fc68b14d1e883a36a411b992ef71a038526e9b15b820985d3bbb7d2
d53203021ea88e690e9254aff60634fbafd324c69bebcd705506046e0647eb88
2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f
07569721866b0b2b3d83ec0db9d400f9cd623c51ea30706aaef9e032ec64795e
db9a46ce4d2d56fb75e4990521c1e905526268b1a6f51311bb8ed6cc6a3ee7b1
ffbd8cb5a8779c934324bbee870d6b1d7549d4c6eb358cd67b923aa8a5b21a36
SH256 hash:
cdcdcb4aaf748b544582e17e0943978b4c45e618e514fb31b943faab462ca699
MD5 hash:
49c405fd1c2b267af2e4db2ef99a8432
SHA1 hash:
982e52102cb67c806aa6de10282f970cc5b27040
Link:
https://www.unpac.me/results/81f2b794-d17c-425c-bb38-9d4460281c89/
SH256 hash:
6f223ef0268638856ceda20ac07da854f4be96ae0b3885d5887c7889143b5b49
MD5 hash:
1e9c79adcc34ca008f801a034434f989
SHA1 hash:
03558acd0a9e047e20b32c6b43adddb6c8bb5642
Link:
https://www.unpac.me/results/81f2b794-d17c-425c-bb38-9d4460281c89/
SH256 hash:
2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f
MD5 hash:
ccc2490450e1a7874b0afe7a6750a277
SHA1 hash:
ad494f6c6d34232ed4126895daa650e7967e4f09
Link:
https://www.unpac.me/results/81f2b794-d17c-425c-bb38-9d4460281c89/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/223342/

Comments