MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b2e37c9809a2ffa234e8eb9fa137fb2188c773a0cf2271514d617efb947d566. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 13

Intelligence 13 IOCs YARA 19 File information Comments

SHA256 hash:	4b2e37c9809a2ffa234e8eb9fa137fb2188c773a0cf2271514d617efb947d566
SHA3-384 hash:	11eb7a68345d61f199123870101703a581d81e8ad3527100703dbf4a4568772028cb54efd98c68613cf2cbcc2e0e2100
SHA1 hash:	00b74ac191c337de1b17b0b6c8aee6ad1746bb82
MD5 hash:	f41ef729f02f8afcdf2cea268db43e84
humanhash:	glucose-low-beryllium-lemon
File name:	Product Listsd̴r̴o̴w̴..exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	2'845'184 bytes
First seen:	2024-05-22 18:44:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	831064be1fe6420831761e783d40c435 (5 x AgentTesla, 1 x Formbook)
ssdeep	24576:+qCdMP5SdezpyFNrhSCPuoX0k6O2BusxExVJhekLg31+mYGnKBFbJETXHOaTKYfj:+P6hSrcCPT0JkLg31+mYGnKDuTXh3z1
Threatray	56 similar samples on MalwareBazaar
TLSH	T16ED5AF05D7E402A4D47BD630CA69D732D371BC591B30D68F0A99FA562F739A28B3B312
TrID	72.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 13.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 2.5% (.EXE) OS/2 Executable (generic) (2029/13) 2.5% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	d4d4dcd6d2d8c4d4 (1 x Formbook)
Reporter	abuse_ch
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

323

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

4b2e37c9809a2ffa234e8eb9fa137fb2188c773a0cf2271514d617efb947d566.exe

Verdict:

Malicious activity

Analysis date:

2024-05-22 20:05:52 UTC

Tags:

formbook stealer spyware

Link:

https://app.any.run/tasks/cc854c6b-af10-4c38-a239-d22d06fd7a4c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Malware.Bladabindi-9867738-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=664e3ee4da0f32dc88983699win7simulatehigh_evasion

Tags:

Network Static Swotter

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Сreating synchronization primitives

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

VHO_Backdoor_Win32_Androm_gen

Link:

https://www.hybrid-analysis.com/sample/4b2e37c9809a2ffa234e8eb9fa137fb2188c773a0cf2271514d617efb947d566

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/761045fa-045c-436e-adb5-44ffa047684a

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1446018

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found direct / indirect Syscall (likely to bypass EDR)

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses nslookup.exe to query domains

Writes to foreign memory regions

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4b2e37c9809a2ffa234e8eb9fa137fb2188c773a0cf2271514d617efb947d566

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4b2e37c9809a2ffa234e8eb9fa137fb2188c773a0cf2271514d617efb947d566/

Threat name:

Win64.Trojan.Swotter

Status:

Malicious

First seen:

2024-05-21 03:56:56 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jmxdpsmatix7ui2or247ue37wimiy5z2btzcofiu2yl67okh2vta._file

Verdict:

malicious

Formbook

5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508

Formbook

8d48681090810cf096230ac8e6900c4cdb22d9872622ba55f9d70c1c1ca32956

Formbook

a0e3a64e0e6aee3370ccbbca59f8ae0b34be674963c1dabe14926b24fdcae7d0

Formbook

ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81

Formbook

+ 46 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/240522-xdjpfsce79/

Behaviour

Runs regedit.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Adds Run key to start application

Adds policy Run key to start application

Unpacked files

SH256 hash:

4b2e37c9809a2ffa234e8eb9fa137fb2188c773a0cf2271514d617efb947d566

MD5 hash:

f41ef729f02f8afcdf2cea268db43e84

SHA1 hash:

00b74ac191c337de1b17b0b6c8aee6ad1746bb82

Link:

https://www.unpac.me/results/08957c1c-eecc-4e5e-a24e-60b331e7a1e4/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4b2e37c9809a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4b2e37c9809a2ffa234e8eb9fa137fb2188c773a0cf2271514d617efb947d566

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::RevertToSelf
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::ImpersonateLoggedOnUser
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessA ADVAPI32.dll::OpenProcessToken KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenThreadToken KERNEL32.dll::VirtualAllocEx KERNEL32.dll::VirtualAllocExNuma
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::DeleteVolumeMountPointW KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetVolumeInformationW KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AllocConsole KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleWindow
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileExW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileExW KERNEL32.dll::ReplaceFileW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_API	Can Encrypt Files	bcrypt.dll::BCryptDestroyKey bcrypt.dll::BCryptGenRandom bcrypt.dll::BCryptOpenAlgorithmProvider bcrypt.dll::BCryptCloseAlgorithmProvider
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW ADVAPI32.dll::RegSetValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample