MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f07775ab256b6bd7dc726fdf62f96728f1b1c2f4b9696f633c81c3f4540f30d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f07775ab256b6bd7dc726fdf62f96728f1b1c2f4b9696f633c81c3f4540f30d
SHA3-384 hash: 5efb41d19913c474ad2049c9343fe1880d83cb2536c27c07a08ea4577e6c5f241842e4778168d8248a42289ff1435781
SHA1 hash: 61d7315a61f77575793e5672f58bf837c4f8385f
MD5 hash: b4e422243d166b21f6e43d8dd95086c7
humanhash: vegan-helium-bravo-cat
File name:b4e422243d166b21f6e43d8dd95086c7
Download: download sample
Signature Formbook
Create hunting rule
File size:342'379 bytes
First seen:2021-11-22 14:23:55 UTC
Last seen:2021-11-22 15:49:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:rGiGJ5zcl2LfXAqqbMur27PsZw2luNapwK5rnE4nT6sA80ZhP:iJ6l2cpbMb7EZw2UayK5zrTtK
Threatray 11'607 similar samples on MalwareBazaar
TLSH T14274230E90D0847AD6CC05721ABDE3F9EBB709C0047A29464B556FFA1BB2EE749542B3
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3e9a853f721f667ded0118f8849a631eb6bf38484a05f2d56db41dd5b0772dd2.xlsx
Verdict:
Malicious activity
Analysis date:
2021-11-19 01:27:10 UTC
Tags:
exploit CVE-2017-11882 loader trojan formbook stealer
Link:
https://app.any.run/tasks/49a1a8f4-202e-413e-972d-cfb920c78748

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.45850.18703.11775.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
formbook overlay packed
Link:
https://www.filescan.io/uploads/619ba80394a88037d2fe7e43/reports/84b946e2-4389-4d68-96d5-f76daef66ba8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5ffe19ef-b7e7-4ba6-9c23-8ce1d8fd6f51
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/893927
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Self deletion via cmd delete
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526405 Sample: PVAEUFrN6w Startdate: 22/11/2021 Architecture: WINDOWS Score: 100 31 www.viffetrade.com 2->31 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for dropped file 2->47 49 3 other signatures 2->49 10 PVAEUFrN6w.exe 17 2->10         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\hpenrdwp.dll, PE32 10->29 dropped 51 Uses ipconfig to lookup or modify the Windows network settings 10->51 53 Tries to detect virtualization through RDTSC time measurements 10->53 55 Injects a PE file into a foreign processes 10->55 14 PVAEUFrN6w.exe 10->14         started        signatures6 process7 signatures8 57 Modifies the context of a thread in another process (thread injection) 14->57 59 Maps a DLL or memory area into another process 14->59 61 Queues an APC in another process (thread injection) 14->61 17 ipconfig.exe 14->17         started        20 explorer.exe 14->20 injected process9 signatures10 35 Self deletion via cmd delete 17->35 37 Modifies the context of a thread in another process (thread injection) 17->37 39 Maps a DLL or memory area into another process 17->39 41 Tries to detect virtualization through RDTSC time measurements 17->41 22 explorer.exe 2 151 17->22         started        25 cmd.exe 1 17->25         started        process11 dnsIp12 33 192.168.2.1 unknown unknown 22->33 27 conhost.exe 25->27         started        process13
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2f07775ab256b6bd7dc726fdf62f96728f1b1c2f4b9696f633c81c3f4540f30d/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 17:26:00 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
27 of 45 (60.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2f6e89afd122fb052c5ad063bfe784b854157f9ff99af0a8aae4b7d19641ff61
Formbook
415d8e7a309e0e7ea9cec8bd06f9170b0dc15aca3a553ff6fa7f6726997800a3
Formbook
4c5887639c1dfcc0349690d98e9c8034029a6fa2f2e6bdbba96371bf23ce3301
Formbook
4cd1e6edc08c369a7e62542c25d5918fdfdc7d7729a078be8235604e20a60302
Formbook
58de41e1c48a304c1f7f289fe5c8976d82b8968aae89497adf7c60cda25deaaf
Formbook
8a13ce3da212f3557c8d3f43a375fa6e030b400c2da2ca9701bed88f839863fc
Formbook
99e25501d1c736865e766fe4e347cda8817f4005be1d7b0c336451b89be71ed2
Formbook
dad44254738682bad3b4582fa66217c68abcc3a8512a825c2f1836e5bbd94c3c
Formbook
fedeb19031bcc0941b0943dd3ed45ee6095b8c489c072c85e513b414abf8acf5
Formbook
+ 11'597 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:dyh6 rat spyware stealer trojan
Link:
https://tria.ge/reports/211122-rqp44safh7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.tttk8.site/dyh6/
Unpacked files
SH256 hash:
2f07775ab256b6bd7dc726fdf62f96728f1b1c2f4b9696f633c81c3f4540f30d
MD5 hash:
b4e422243d166b21f6e43d8dd95086c7
SHA1 hash:
61d7315a61f77575793e5672f58bf837c4f8385f
Link:
https://www.unpac.me/results/51305f51-9d8b-40d0-b9c2-f2aefd436146/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/2f07775ab256b6bd7dc726fdf62f96728f1b1c2f4b9696f633c81c3f4540f30d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 2f07775ab256b6bd7dc726fdf62f96728f1b1c2f4b9696f633c81c3f4540f30d

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1805101/
Cape
Cape
https://www.capesandbox.com/analysis/208222/

Comments


Avatar
zbet commented on 2021-11-22 14:23:57 UTC

url : hxxp://downloads.dd.com.mt/maxf.exe