MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4634683041f3a17fd3e66e086f2730d0f130bcbb0cd55594a697f140a43f87be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4634683041f3a17fd3e66e086f2730d0f130bcbb0cd55594a697f140a43f87be
SHA3-384 hash: 06dd806ba50c057cbb87d78950895a85ee7fc90b6ce75b71f135ab6f0ec08da088aa42e00b4e85fcc96b853dd45dc7b5
SHA1 hash: 6c32ba5cbe881b48b7b2d7d4292d4b1986fc0c45
MD5 hash: 6c4c617235a55f368eb2b8f30bde5348
humanhash: fish-xray-thirteen-carpet
File name:Glgcjrikwubeurawzvfntcaqnlnuvkpnql_Signed_.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:972'792 bytes
First seen:2021-05-20 12:39:30 UTC
Last seen:2021-05-20 14:08:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f1f303542c50f6c0da1211eb61b35269 (1 x NetWire, 1 x Formbook)
ssdeep 24576:9TgC9qG4RR6IoNcOySxfzyk+1fIlW+S6:iC3Wug6g+t
Threatray 5'388 similar samples on MalwareBazaar
TLSH 702548E599430437D23E1938385692997826AF102A6B7DB67AB83D084FF46D13C3B1DF
Reporter info_sec_ca
Tags:exe FormBook signed

Code Signing Certificate

Organisation:win.rar GmbH
Issuer:COMODO RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2015-06-01T00:00:00Z
Valid to:2017-05-31T23:59:59Z
Serial number: fe46a10ad94269c3dd225c13645352e4
Thumbprint Algorithm:SHA256
Thumbprint: 364e27b642056a2856be0dae519e044362d2170f36e9217e2335307cf57dfecb
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/159616/
Detection(s):
SecuriteInfo.com.LresultFromObject.9340.20381.UNOFFICIAL
Create hunting rule

Win.Malware.Fhrt-9863084-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Sending a UDP request
Creating a file
Deleting a recently created file
Launching a process
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/786181
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Execution from Suspicious Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 418577 Sample: Glgcjrikwubeurawzvfntcaqnln... Startdate: 20/05/2021 Architecture: WINDOWS Score: 100 37 www.kambosito.space 2->37 65 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->65 67 Found malware configuration 2->67 69 Malicious sample detected (through community Yara rule) 2->69 71 6 other signatures 2->71 10 Glgcjrikwubeurawzvfntcaqnlnuvkpnql_Signed_.exe 1 19 2->10         started        signatures3 process4 dnsIp5 57 qjajga.dm.files.1drv.com 10->57 59 onedrive.live.com 10->59 61 dm-files.fe.1drv.com 10->61 35 C:\Users\Publicbehaviorgraphlgcjrbehaviorgraphlgcjr.exe, PE32 10->35 dropped 93 Writes to foreign memory regions 10->93 95 Allocates memory in foreign processes 10->95 97 Creates a thread in another existing process (thread injection) 10->97 99 Injects a PE file into a foreign processes 10->99 15 dialer.exe 10->15         started        file6 signatures7 process8 signatures9 101 Modifies the context of a thread in another process (thread injection) 15->101 103 Maps a DLL or memory area into another process 15->103 105 Sample uses process hollowing technique 15->105 107 2 other signatures 15->107 18 explorer.exe 4 15->18 injected process10 dnsIp11 39 paintwaterlilly.com 50.87.248.14, 49761, 80 UNIFIEDLAYER-AS-1US United States 18->39 41 www.lazycooked.com 35.209.239.82, 49753, 80 GOOGLE-2US United States 18->41 43 17 other IPs or domains 18->43 73 System process connects to network (likely due to code injection or exploit) 18->73 22 Glgcjr.exe 16 18->22         started        26 Glgcjr.exe 16 18->26         started        28 msiexec.exe 18->28         started        signatures12 process13 dnsIp14 45 qjajga.dm.files.1drv.com 22->45 47 onedrive.live.com 22->47 49 dm-files.fe.1drv.com 22->49 75 Multi AV Scanner detection for dropped file 22->75 77 Machine Learning detection for dropped file 22->77 79 Writes to foreign memory regions 22->79 30 ieinstal.exe 22->30         started        51 192.168.2.1 unknown unknown 26->51 53 qjajga.dm.files.1drv.com 26->53 55 2 other IPs or domains 26->55 81 Allocates memory in foreign processes 26->81 83 Creates a thread in another existing process (thread injection) 26->83 85 Injects a PE file into a foreign processes 26->85 32 logagent.exe 26->32         started        87 Modifies the context of a thread in another process (thread injection) 28->87 89 Maps a DLL or memory area into another process 28->89 91 Tries to detect virtualization through RDTSC time measurements 28->91 signatures15 process16 signatures17 63 Tries to detect virtualization through RDTSC time measurements 32->63
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4634683041f3a17fd3e66e086f2730d0f130bcbb0cd55594a697f140a43f87be/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-05-19 21:59:52 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iy2gqmcb6oqx7u7gnyeg6jzq2dytbpf3btkvlffgs7yubjb7q67a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1d4caa0b975ecf0bcb2cc854e5704a7a47d97aac648e0b3634143354c98aacb9
Formbook
33f0d367ae282d4c9b9a6acbfefd3e86999eb84fc65c43d99f1de1b95c1f80af
Formbook
37a8922f49037f65771bc1e4ab9d7fbb4b1c27ce2bc79fe618705f4d90ad7615
Formbook
48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125
Formbook
4bed9bf05fbe39e5c647087ae6384aba6aeef1f7cb730df31d87a40abd4bc7fe
Formbook
6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48
Formbook
6fac6e1f7f8cdd8cec52b2dd7a23fd434084c7d12ef0f04deaa52794d3612ef7
Formbook
8855c73a66320b1d62c22f7af62feb301d13e4b68f4edfba64bf47473ad58c4a
Formbook
aace20e28e61cb328da74ff938231b1ce9a07498d477efe3efc5c5d3d04b9dc1
Formbook
be104552eacbe49cf13a5097c5856782c1b07531bd2eb2e4db5bcef7edc14b6a
Formbook
+ 5'378 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210520-bpw3e148ln/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4634683041f3a17fd3e66e086f2730d0f130bcbb0cd55594a697f140a43f87be

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/159616/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-20 13:08:37 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
2) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
3) [B0012.001] Anti-Static Analysis::Argument Obfuscation
4) [F0002.001] Collection::Application Hook
5) [F0002.002] Collection::Polling
7) [C0026.002] Data Micro-objective::XOR::Encode Data
9) [C0049] File System Micro-objective::Get File Attributes
10) [C0051] File System Micro-objective::Read File
11) [C0052] File System Micro-objective::Writes File
12) [E1510] Impact::Clipboard Modification
13) [C0007] Memory Micro-objective::Allocate Memory
14) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
15) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
16) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
17) [C0038] Process Micro-objective::Create Thread
18) [C0041] Process Micro-objective::Set Thread Local Storage Value
19) [C0018] Process Micro-objective::Terminate Process