MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381
SHA3-384 hash: 963304226be85cbf470c29c5f424264f1c09be54845a0a3c3004d5ba0823c9b8b8e15ece1fc75b7a097bd96dbda6c94b
SHA1 hash: c2fbe6123feea032e62ac2fa0c56e0a09f2df67e
MD5 hash: 932b776b87e459c404ae7e9ca38a0c7e
humanhash: single-september-michigan-july
File name:wininit.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:944'128 bytes
First seen:2023-08-23 07:43:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:o0wNK+LSjMM6I7EjObh43pwlPdO/6jd923a79GNBkrRL74K73wtf2T+:FRjB7a/s23CkAEZ
Threatray 1'754 similar samples on MalwareBazaar
TLSH T1C815EC2835AA510AF2729E755FFCB5B1905EF6F225720C6F19F7030A22529F0CB9C53A
TrID 28.5% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
13.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.2% (.EXE) Win32 Executable (generic) (4505/5/1)
5.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon d4a6a494a48484a4 (65 x AgentTesla, 39 x Formbook, 8 x RemcosRAT)
Reporter petrovic
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
310
Origin country :
FI FI
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
5890796959.xls
Verdict:
Malicious activity
Analysis date:
2023-08-23 05:50:55 UTC
Tags:
opendir exploit cve-2017-11882 loader formbook stealer spyware
Link:
https://app.any.run/tasks/0599b1b7-eb40-4327-a81a-e8401a5d39e9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/444285/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.50.UNOFFICIAL
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file
Sending a custom TCP request
Forced shutdown of a system process
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/971b81a9-b816-4ac3-8848-3a09bc3b36c7
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1295698
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1295698 Sample: wininit.exe Startdate: 23/08/2023 Architecture: WINDOWS Score: 100 40 Snort IDS alert for network traffic 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 6 other signatures 2->46 9 wininit.exe 1 2->9         started        process3 signatures4 50 Writes to foreign memory regions 9->50 52 Allocates memory in foreign processes 9->52 54 Injects a PE file into a foreign processes 9->54 12 CasPol.exe 9->12         started        process5 signatures6 56 Maps a DLL or memory area into another process 12->56 58 Sample uses process hollowing technique 12->58 60 Queues an APC in another process (thread injection) 12->60 15 obEpSIXRrTEmadRD.exe 12->15 injected process7 process8 17 mstsc.exe 13 15->17         started        signatures9 32 Tries to steal Mail credentials (via file / registry access) 17->32 34 Tries to harvest and steal browser information (history, passwords, etc) 17->34 36 Modifies the context of a thread in another process (thread injection) 17->36 38 Maps a DLL or memory area into another process 17->38 20 explorer.exe 4 1 17->20 injected 24 obEpSIXRrTEmadRD.exe 17->24 injected process10 dnsIp11 26 acdaiucdac.com 165.140.70.70, 49774, 49775, 49776 WISCNET1-ASUS Reserved 20->26 28 www.playcups.life 203.161.58.192, 49752, 49753, 49754 VNPT-AS-VNVNPTCorpVN Malaysia 20->28 30 15 other IPs or domains 20->30 48 System process connects to network (likely due to code injection or exploit) 20->48 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-08-22 17:24:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
27 of 37 (72.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hfoaqakwaiq57n5u64e4dracho4apprfajyhjk4xvsdjhyutwoaq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
14ae647473cbf4def9becdbbb1f007fd8c96c63be5c88014415ab13e6467168f
Formbook
572e8b2c173dc361f25400cbbba7a980cea2dcdf91e1245902f31d05387cec1f
Formbook
5c58e2edb4b7fa9a04901a73e7f34e5a93aec5703e03ec87f79b2799b7be7119
Formbook
713295015c5460b487bd9e9fbe4ac0e600791a47911852e5a5feec1bafbb55fe
Formbook
736808fef49ea666d160c9943b624f0ad79c3d10c44b8042a602d8a31d2465a3
Formbook
9442fbb4a8b6fff536bf913966cf56849bd7808397a8426ce01fbe1c0577a2ef
Formbook
ab014726aed51970dfc05e4afc3269d5d4ab208c480683ca4da49fe07d3fc90e
Formbook
b2f634be000cf32e481c6f66928d8a428a3481f17c7a045a39150bdf9ae6dbe7
Formbook
b35cfe6096c42b13838fcad82902889405e6d37607aebd86ab982b47b610c80c
Formbook
ed570698ccddfc346f65b5b86045d8af239e0d2400acd5836818b95e7b658cff
Formbook
+ 1'744 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230823-jktw4saf54/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
341600e5fe8f53faf04eadc6390e471dc2444ab28691514af8b74c8b561d9a5b
MD5 hash:
67663152c1f736896ce8322eafc835ff
SHA1 hash:
4820664daf28d13d8c9ca922fd86d46c6eb7bff1
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/1ecd6ad9-b1dd-4774-8778-da13e31af730/
Parent samples :
8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
fed8358d2eb6cd687bb6f6a88b4f8bc01bd5dcf355535532718a0f04f1eff674
c7616a546f8e22dd0a80b275f5991b6c6ab567d278be339904d6bff0c5c00a42
9e9af76a8585a7b99a59f042f64a711aaa8f9bfb68a4040ca522147470d6b6de
72d3a95a59ccd8220e04850fb54fdc48caa51c10739d96afa48ab5446303dc07
5348bcccead193b46acc11339b9c3ff05395753d536a0952641af34382e08604
20d45ab8062d59db6229e293a604f37e2760519894d07380288f0f8f5e2b5c95
adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c
a0c810baccbd3943748568d16e5b9cdf6b829364c8e4b21cda09c4f865b228f0
5e0519cad57279ab39f475c7ec22d2435a4a69f2378cf2254745e089f5c174fb
8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381
31fd5ab4ff38fd42399d4d90a19da71b94cd7ba47b0a97ce1bda37958ce97ef6
SH256 hash:
78eaae7f782e4b12d7d47f290ddaae74c19373393bb86673fb25633b7fcbc7c9
MD5 hash:
be26954f9951b84a519797424fc52ee1
SHA1 hash:
8228036eb552bf7679f37cbd463d3f911d29964e
Link:
https://www.unpac.me/results/1ecd6ad9-b1dd-4774-8778-da13e31af730/
SH256 hash:
be2284d49ae7ecd68f4013d549717634e4d75bec77aa59eb8b81710a48e81fb8
MD5 hash:
f1c62c6e718280d0d36bfcf2eef6154d
SHA1 hash:
61b6f1d5c804684c42a10f65601d029154d55608
Link:
https://www.unpac.me/results/1ecd6ad9-b1dd-4774-8778-da13e31af730/
SH256 hash:
395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381
MD5 hash:
932b776b87e459c404ae7e9ca38a0c7e
SHA1 hash:
c2fbe6123feea032e62ac2fa0c56e0a09f2df67e
Link:
https://www.unpac.me/results/1ecd6ad9-b1dd-4774-8778-da13e31af730/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/395c08015602/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/444285/
  
URLhaus
https://urlhaus.abuse.ch/url/2706374/
  
Delivery method
Distributed via web download

Comments