MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125
SHA3-384 hash: 621209a2d22c3b057980e3083d49afc192c8daa84777aade28914abb7027056c67338121adc9a7fc61a2c1b72171b059
SHA1 hash: f22073cb3a889efbe7412802885f64778c6a0139
MD5 hash: 75835dd5ce974af3a4d73e8ed4ca8632
humanhash: earth-pip-missouri-black
File name:Ygqayrvpsvjdxblkzsmxymjfnxukvrdvft_Signed_.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'177'224 bytes
First seen:2021-04-30 20:52:37 UTC
Last seen:2021-04-30 21:50:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3b55998301bfa58c425fb4920f1bf5d1 (1 x RemcosRAT, 1 x Formbook)
ssdeep 24576:Dny7bq4xOMVzeSxTqWgmsTws461lsv0yUya97cad6/xd6QWzhfOefD6HLhUD/Ftp:Dmo4fjhs4Q97cad6/xd6QWzbfhFtFvDj
Threatray 5'029 similar samples on MalwareBazaar
TLSH 1745BEA37380447EC92E5A31AC17B2601519FD6B9ECC914D37F8BD4B2FB57C22826E52
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/147785/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36822690.5195.28285.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Deleting a recently created file
Running batch commands
Creating a process with a hidden window
Launching a process
Launching cmd.exe command interpreter
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/705742
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
DLL side loading technique detected
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files to the user root directory
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: APT29
Sigma detected: Covenant Launcher Indicators
Sigma detected: Disable of ETW Trace
Sigma detected: Execution from Suspicious Folder
Sigma detected: Exploiting SetupComplete.cmd CVE-2019-1378
Sigma detected: Koadic Execution
Sigma detected: Mustang Panda Dropper
Sigma detected: PowerShell DownloadFile
Sigma detected: Ryuk Ransomware
Sigma detected: Suspicious Eventlog Clear or Configuration Using Wevtutil
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 401794 Sample: Ygqayrvpsvjdxblkzsmxymjfnxu... Startdate: 30/04/2021 Architecture: WINDOWS Score: 100 69 www.paintwaterlilly.com 2->69 71 www.evaair-dailoan.com 2->71 73 paintwaterlilly.com 2->73 107 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->107 109 Found malware configuration 2->109 111 Malicious sample detected (through community Yara rule) 2->111 113 14 other signatures 2->113 11 Ygqayrvpsvjdxblkzsmxymjfnxukvrdvft_Signed_.exe 1 25 2->11         started        signatures3 process4 dnsIp5 81 xhttpg.dm.files.1drv.com 11->81 83 onedrive.live.com 11->83 85 dm-files.fe.1drv.com 11->85 61 C:\Users\Public61etplwiz.exe, PE32+ 11->61 dropped 63 C:\Users\Public63ETUTILS.dll, PE32+ 11->63 dropped 65 C:\Users\Public\Libraries\Ygqayr\Ygqayr.exe, PE32 11->65 dropped 67 3 other malicious files 11->67 dropped 119 Drops PE files to the user root directory 11->119 121 Writes to foreign memory regions 11->121 123 Allocates memory in foreign processes 11->123 125 2 other signatures 11->125 16 secinit.exe 11->16         started        19 cmd.exe 1 11->19         started        file6 signatures7 process8 signatures9 99 Modifies the context of a thread in another process (thread injection) 16->99 101 Maps a DLL or memory area into another process 16->101 103 Sample uses process hollowing technique 16->103 105 2 other signatures 16->105 21 explorer.exe 16->21 injected 25 conhost.exe 19->25         started        27 cmd.exe 5 19->27         started        process10 dnsIp11 75 skinnybrew.asia 103.27.32.39, 49738, 80 SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU Australia 21->75 77 www.kmakeupbrushes.com 47.88.24.96, 49759, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 21->77 79 14 other IPs or domains 21->79 115 System process connects to network (likely due to code injection or exploit) 21->115 30 Ygqayr.exe 16 21->30         started        34 Ygqayr.exe 16 21->34         started        36 raserver.exe 21->36         started        38 cmmon32.exe 21->38         started        40 cmd.exe 1 25->40         started        57 C:\Windows \System3257etplwiz.exe, PE32+ 27->57 dropped 59 C:\Windows \System3259ETUTILS.dll, PE32+ 27->59 dropped 117 Drops executables to the windows directory (C:\Windows) and starts them 27->117 42 conhost.exe 27->42         started        44 Netplwiz.exe 27->44         started        file12 signatures13 process14 dnsIp15 87 xhttpg.dm.files.1drv.com 30->87 89 onedrive.live.com 30->89 91 dm-files.fe.1drv.com 30->91 137 Multi AV Scanner detection for dropped file 30->137 139 Writes to foreign memory regions 30->139 141 Allocates memory in foreign processes 30->141 46 secinit.exe 30->46         started        93 xhttpg.dm.files.1drv.com 34->93 95 onedrive.live.com 34->95 97 dm-files.fe.1drv.com 34->97 143 Creates a thread in another existing process (thread injection) 34->143 145 Injects a PE file into a foreign processes 34->145 49 mobsync.exe 34->49         started        147 Modifies the context of a thread in another process (thread injection) 36->147 149 Maps a DLL or memory area into another process 36->149 151 DLL side loading technique detected 36->151 153 Tries to detect virtualization through RDTSC time measurements 38->153 155 Suspicious powershell command line found 40->155 157 Adds a directory exclusion to Windows Defender 40->157 51 powershell.exe 27 40->51         started        53 conhost.exe 40->53         started        signatures16 process17 signatures18 127 Modifies the context of a thread in another process (thread injection) 46->127 129 Maps a DLL or memory area into another process 46->129 131 Sample uses process hollowing technique 46->131 133 Tries to detect virtualization through RDTSC time measurements 49->133 135 DLL side loading technique detected 51->135 55 conhost.exe 51->55         started        process19
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-04-30 16:21:11 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jdl65bjew3czj3rqsz77ucymmup7b2sucyvkcqxbh7gzzgsxoesq._file
Verdict:
malicious
Similar samples:
0132bc0987f049d7527b99c657edefbf62eefcc9bdb4766e6066160ca0bdf4e2
Formbook
34066150ffa7efa505b8d2246925cd8a32f83b9609438ae76aa27cef7388054d
Formbook
36dabaa854dac855255b08b096a1fb6cee39f910dfbd2101812a0c5d33b1a983
Formbook
37a8922f49037f65771bc1e4ab9d7fbb4b1c27ce2bc79fe618705f4d90ad7615
Formbook
3c5cf190ba17e8138feadf46a81dbdafff69ecd8b9122aaf4967fbd9aa79c1f6
Formbook
5acfc6aa1ccbdc619df590b1b8092e0c1687558b7f01a7015a20d2a146e60a7f
Formbook
6657aeabd5ded830361aad9112749d785fc0fbe46121daeb7acb23cd841274ed
Formbook
9b8e02c9169932cb809300c4dff5afc240aba4d5a87264f0f7123314345c6248
Formbook
cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
Formbook
e6e9f774351440aef9b0b309282155ad0258f6e97da820170384454711e4bef8
Formbook
+ 5'019 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader persistence rat
Link:
https://tria.ge/reports/210430-tcmwjft3ka/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.clinics.life/qku9/
Unpacked files
SH256 hash:
8f63001a412f92b1e28e17cf0ca84b5d4fa126a661cdae11c5221b7344c26999
MD5 hash:
77fbc4c0b74cf1b87fa3804f3c4c0ff1
SHA1 hash:
721f7b2c9db79c8a34b8ad43f103b22df632d2dc
Link:
https://www.unpac.me/results/b3da45bc-f876-4861-8bd7-cd9f7df87a05/
SH256 hash:
48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125
MD5 hash:
75835dd5ce974af3a4d73e8ed4ca8632
SHA1 hash:
f22073cb3a889efbe7412802885f64778c6a0139
Link:
https://www.unpac.me/results/b3da45bc-f876-4861-8bd7-cd9f7df87a05/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_0be3f393d1ef0272aed0e2319c1b5dd0
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:MALWARE_Win_DLAgent07
Create hunting rule
Author:ditekSHen
Description:Detects delf downloader agent

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/147785/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-30 21:02:55 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
2) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
3) [F0002.002] Collection::Polling
5) [C0026.002] Data Micro-objective::XOR::Encode Data
7) [C0051] File System Micro-objective::Read File
8) [C0052] File System Micro-objective::Writes File
9) [C0007] Memory Micro-objective::Allocate Memory
10) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
11) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
12) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
13) [C0038] Process Micro-objective::Create Thread
14) [C0041] Process Micro-objective::Set Thread Local Storage Value
15) [C0018] Process Micro-objective::Terminate Process