MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36f828fc51e022714a6fd634e6b663919f332b67e9505ceb05d5c3b9398c6a00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36f828fc51e022714a6fd634e6b663919f332b67e9505ceb05d5c3b9398c6a00
SHA3-384 hash: 854e962043045e8d74afa9def8e5dff8cf6ff83474742397a250b4fb0c6d209ac8c4b69730a5aefa31c89ec029320c8b
SHA1 hash: d27b20602db59697c20293d02aef1e433f98baf4
MD5 hash: 9190513275b80db066cc1a2275c01af1
humanhash: wisconsin-ink-video-lake
File name:PRE ALERT NOTICE.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'258'496 bytes
First seen:2023-01-05 06:17:42 UTC
Last seen:2023-01-05 14:13:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:3Cw0bu5zZm+Sxkxm/X7hddTg1k8WtEGPObozGVzrj2roUVxAvWkZxsqJyMkZ6yEe:3ClP78fLPTu69tCT/4jwCv
Threatray 888 similar samples on MalwareBazaar
TLSH T1C645493439FA501AB173EFAA9BE475D6DA6FB7733B02645D1090038A4723A81DEC153E
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter Anonymous
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PRE ALERT NOTICE.zip
Verdict:
No threats detected
Analysis date:
2023-01-05 00:47:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f234aaa9-d76c-47f7-942f-d3bced826868

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/349541/
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.19050.8761.4803.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Launching a process
Creating a file
Сreating synchronization primitives
Searching for synchronization primitives
Searching for the window
DNS request
Sending an HTTP GET request
Reading critical registry keys
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Launching the default Windows debugger (dwwin.exe)
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63b66b9ca70bef46551d23d8/reports/fa71e115-e41c-440a-8f29-9792864d1120/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bb1e5908-88c8-4a21-9d5e-4dc383bbb55a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1145460
Signature
.NET source code contains very large strings
Antivirus detection for URL or domain
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 778192 Sample: PRE ALERT NOTICE.exe Startdate: 05/01/2023 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 Antivirus detection for URL or domain 2->40 42 7 other signatures 2->42 8 PRE ALERT NOTICE.exe 4 2->8         started        process3 file4 28 C:\Users\user\...\PRE ALERT NOTICE.exe.log, CSV 8->28 dropped 46 Writes to foreign memory regions 8->46 48 Injects a PE file into a foreign processes 8->48 12 AddInProcess32.exe 8->12         started        15 conhost.exe 8->15         started        17 DataSvcUtil.exe 8->17         started        19 2 other processes 8->19 signatures5 process6 signatures7 58 Modifies the context of a thread in another process (thread injection) 12->58 60 Maps a DLL or memory area into another process 12->60 62 Sample uses process hollowing technique 12->62 64 Queues an APC in another process (thread injection) 12->64 21 explorer.exe 12->21 injected process8 dnsIp9 30 www.ombqe.top 154.82.93.7, 49704, 49705, 49706 ROOTNETWORKSUS Seychelles 21->30 32 chaatfunnnet.skin 63.250.38.159, 49700, 80 NAMECHEAP-NETUS United States 21->32 34 6 other IPs or domains 21->34 44 System process connects to network (likely due to code injection or exploit) 21->44 25 help.exe 13 21->25         started        signatures10 process11 signatures12 50 Tries to steal Mail credentials (via file / registry access) 25->50 52 Tries to harvest and steal browser information (history, passwords, etc) 25->52 54 Modifies the context of a thread in another process (thread injection) 25->54 56 Maps a DLL or memory area into another process 25->56
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36f828fc51e022714a6fd634e6b663919f332b67e9505ceb05d5c3b9398c6a00/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2023-01-04 12:13:19 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
2
AV detection:
3 of 39 (7.69%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g34cr7cr4arhcstp2y2onntdsgptgk3h5fifz2yf2xb3sommniaa._file
Verdict:
malicious
Similar samples:
17fad325e9717e20c930f698f08f711320a505560e239b5de9df67c62258a3bd
Formbook
226afa3df5af5aa68c49d93ba24b95cd64cf21f8db4d86f3454c60773cdc9568
Formbook
2b073d2e7346d127fc364606a3f875936dc9122763f324e449663da114040c98
Formbook
9d9849b524012665ec0676be4eb85efcd6d51bf1dd4a68c13f364f6e74c4bc60
Formbook
ac1bbc53ec6158d8dfa191b81292c96d8fb106d4ea196a6bef55027e0702b6f9
Formbook
b0e2ee5d5dcf0c508bd3f0d3016bc483d880ae94120fe214a4bff996bcc074aa
Formbook
b67c389fc71d512caba10e28fb950648a2971e42581698e1191f7583da2b8309
Formbook
d1ca3f8fb1acd28ee6ce1227880e74fca8aa908ca373931a5180f3cb76bb8fe1
Formbook
dc72c7525da8aa1afaadaf707499054dd9be20d0c78318d2f63af1fa37d58546
Formbook
fcfe4c075c3b67f661de261a2f05ce34d1b9b150c286c67a3da085b006ae7b3c
Formbook
+ 878 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230105-g2lwqaba98/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9030459a-6f43-484a-9e02-13db06be5fce
Unpacked files
SH256 hash:
36f828fc51e022714a6fd634e6b663919f332b67e9505ceb05d5c3b9398c6a00
MD5 hash:
9190513275b80db066cc1a2275c01af1
SHA1 hash:
d27b20602db59697c20293d02aef1e433f98baf4
Link:
https://www.unpac.me/results/97b52462-a481-438a-94f6-cf7d6fe3b621/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/36f828fc51e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/36f828fc51e022714a6fd634e6b663919f332b67e9505ceb05d5c3b9398c6a00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip ee5f89131e85132d14a0cfd2cec62c7c21a845f2c02ef08bda36c6fbd7847526

Formbook

Executable exe 36f828fc51e022714a6fd634e6b663919f332b67e9505ceb05d5c3b9398c6a00

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/349541/
  
Dropped by
SHA256 ee5f89131e85132d14a0cfd2cec62c7c21a845f2c02ef08bda36c6fbd7847526
  
Dropped by
MD5 6c8bbe84542c45ea41d97690e5bc4095

Comments