MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c5f93d8e4ad69e493366b4bbdd56b7e9b39ad3d25913162a050a68ea9206b50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c5f93d8e4ad69e493366b4bbdd56b7e9b39ad3d25913162a050a68ea9206b50
SHA3-384 hash: a5b2f77e756ed2880b91ca6f9b3164f0ed462401dcbaee8f416396857b35d95fa0135e51f3d7ef449796c0db216833a2
SHA1 hash: be2ef19b9a965d5c284e7e73fe4a257339d30712
MD5 hash: c0f8a3f565f5c70e92e278af670fc748
humanhash: nineteen-wisconsin-stream-jig
File name:c0f8a3f565f5c70e92e278af670fc748
Download: download sample
Signature Formbook
Create hunting rule
File size:265'564 bytes
First seen:2022-10-22 07:45:04 UTC
Last seen:2022-10-22 10:27:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (728 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 6144:mbE/HUbqSyYW+b4j+6K9Jcwv0+WpXKcYEcZqAJd3QjFFi0gZP:mb/1aYt6K9Jnv0nYGAfKa0wP
Threatray 18'276 similar samples on MalwareBazaar
TLSH T1B8441209F6F4E597D0B05731287723AA8AF6B5191AA53F4703607EB57CA3CA0EC1EB05
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
INV_telex_advice_copy_20210202200000000000000020.docx
Verdict:
Malicious activity
Analysis date:
2022-10-22 06:33:07 UTC
Tags:
trojan opendir exploit cve-2017-11882 loader formbook stealer
Link:
https://app.any.run/tasks/8fa2fea1-77fe-4c84-b2c1-347f4b7b9a92

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/322571/
Detection(s):
SecuriteInfo.com.Trojan.Garf.Gen.7.8706.16258.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for synchronization primitives
Launching a process
Searching for the window
DNS request
Sending an HTTP GET request
Reading critical registry keys
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/44344/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed shell32.dll zusy
Link:
https://www.filescan.io/uploads/63539fbb898b0652a4b953fb/reports/919d6ab4-79f6-477e-b394-fa5c7b9efc63/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a90394cf-04ae-4650-a571-d7bdb99ffbce
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1095384
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Found hidden mapped module (file has been removed from disk)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netstat to query active network connections and open ports
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 728025 Sample: r6eojVTG4I.exe Startdate: 22/10/2022 Architecture: WINDOWS Score: 100 102 Multi AV Scanner detection for domain / URL 2->102 104 Malicious sample detected (through community Yara rule) 2->104 106 Antivirus detection for URL or domain 2->106 108 6 other signatures 2->108 11 r6eojVTG4I.exe 18 2->11         started        process3 file4 62 C:\Users\user\AppData\...\shxwusapzd.exe, PE32 11->62 dropped 14 shxwusapzd.exe 1 6 11->14         started        process5 file6 64 C:\Users\user\AppData\...\cipnsjxwa.exe, PE32 14->64 dropped 66 C:\Users\user\AppData\Local\Temp\968F.tmp, PE32 14->66 dropped 68 C:\Users\user\AppData\Local\Temp\8FB8.tmp, PE32 14->68 dropped 70 C:\Users\user\AppData\Local\Temp\8C6B.tmp, PE32 14->70 dropped 126 Multi AV Scanner detection for dropped file 14->126 128 Machine Learning detection for dropped file 14->128 130 Creates multiple autostart registry keys 14->130 132 Found hidden mapped module (file has been removed from disk) 14->132 18 shxwusapzd.exe 14->18         started        21 WerFault.exe 23 9 14->21         started        23 conhost.exe 14->23         started        25 2 other processes 14->25 signatures7 process8 signatures9 110 Modifies the context of a thread in another process (thread injection) 18->110 112 Maps a DLL or memory area into another process 18->112 114 Sample uses process hollowing technique 18->114 116 Queues an APC in another process (thread injection) 18->116 27 explorer.exe 1 18->27 injected process10 dnsIp11 80 www.fluyama.com 217.160.0.249, 49735, 49736, 49737 ONEANDONE-ASBrauerstrasse48DE Germany 27->80 82 myrgroupinc.com 64.20.56.162, 49760, 49761, 49762 IS-AS-1US United States 27->82 84 4 other IPs or domains 27->84 124 System process connects to network (likely due to code injection or exploit) 27->124 31 cipnsjxwa.exe 2 27->31         started        35 chkdsk.exe 1 13 27->35         started        37 cipnsjxwa.exe 2 27->37         started        39 5 other processes 27->39 signatures12 process13 file14 72 C:\Users\user\AppData\Local\Temp\47BC.tmp, PE32 31->72 dropped 86 Multi AV Scanner detection for dropped file 31->86 88 Machine Learning detection for dropped file 31->88 90 Uses netstat to query active network connections and open ports 31->90 92 Found hidden mapped module (file has been removed from disk) 31->92 41 cipnsjxwa.exe 31->41         started        44 WerFault.exe 10 31->44         started        46 conhost.exe 31->46         started        94 Tries to steal Mail credentials (via file / registry access) 35->94 96 Creates multiple autostart registry keys 35->96 98 Tries to harvest and steal browser information (history, passwords, etc) 35->98 100 2 other signatures 35->100 74 C:\Users\user\AppData\Local\Temp\BFFC.tmp, PE32 37->74 dropped 48 cipnsjxwa.exe 37->48         started        50 WerFault.exe 10 37->50         started        52 conhost.exe 37->52         started        76 C:\Users\user\AppData\Local\Temp\DA45.tmp, PE32 39->76 dropped 78 C:\Users\user\AppData\Local\Temp\AF3E.tmp, PE32 39->78 dropped 54 conhost.exe 39->54         started        56 cipnsjxwa.exe 39->56         started        58 3 other processes 39->58 signatures15 process16 signatures17 118 Modifies the context of a thread in another process (thread injection) 48->118 120 Maps a DLL or memory area into another process 48->120 122 Sample uses process hollowing technique 48->122 60 NETSTAT.EXE 48->60         started        process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c5f93d8e4ad69e493366b4bbdd56b7e9b39ad3d25913162a050a68ea9206b50/
Threat name:
Win32.Trojan.NSISInject
Create hunting rule
Status:
Malicious
First seen:
2022-10-21 15:07:00 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jrpzhwhevvu6jezwnnf33vllp2nttlj5ewitcyvakcti5kjannia._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0cf04aa0803e2075837ea0ff69ba2b7d50884eff30677baa63770b467d952415
Formbook
2fc9bef4467f94362f4860fa9f501640b8a0964154fe5f2d8200f3d67b825b79
Formbook
4eecf4c73d1d4ce4d43ecd6b4d1d3e9c5ea8a310b2cb45e9bf16847863febf4f
Formbook
53304618643cdc79b032becca67d8f5b29e7202ec25e7bb724ce712a03ec6592
Formbook
7ca3b28aa32d6b9bd972c430c47691db7212f9fd7b713c3ff2fab8b10a0bd66a
Formbook
96cf18e2a423b74f89f810553f9b4ba3859bd2f71172facfc8911c6cf6221881
Formbook
b1248c9a9d2892a23cd6927ccfad438e360f5977e47c38d424522e7d67d10816
Formbook
bbb16ff7e472adf4acdcf9576a2977b930f36622848b2f0c3e954f6916a273c9
Formbook
fed743ba97ee8b48a3925816de1b2665d2a73bbf3bc75083fb9ade2855afc0ce
Formbook
+ 18'266 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ubpr persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/221022-jlyxfsbef8/
Behaviour
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1f41e46b-9369-4f82-adf9-23b5c15d70ee
Unpacked files
SH256 hash:
a9b9dd5b3026334533297a592465c4b85d04fc64bed66a7ac8aaf7d91341e40a
MD5 hash:
e56e615404ddfc441c20857a11d7583c
SHA1 hash:
0e7a639fc705523faf113cec3ae5fe87af039859
Link:
https://www.unpac.me/results/63404094-4576-4680-95b0-b52eecf69f54/
SH256 hash:
eb2c1ab613e0040461670bc5042550a4c02d7e00b608b5da43c801c5f919875f
MD5 hash:
af128bab1c47be6018d439d442d121f9
SHA1 hash:
5e7135590970f3f1c146541268f1332a4b256ead
Link:
https://www.unpac.me/results/63404094-4576-4680-95b0-b52eecf69f54/
SH256 hash:
4c5f93d8e4ad69e493366b4bbdd56b7e9b39ad3d25913162a050a68ea9206b50
MD5 hash:
c0f8a3f565f5c70e92e278af670fc748
SHA1 hash:
be2ef19b9a965d5c284e7e73fe4a257339d30712
Link:
https://www.unpac.me/results/63404094-4576-4680-95b0-b52eecf69f54/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4c5f93d8e4ad/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4c5f93d8e4ad69e493366b4bbdd56b7e9b39ad3d25913162a050a68ea9206b50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 4c5f93d8e4ad69e493366b4bbdd56b7e9b39ad3d25913162a050a68ea9206b50

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2381654/
Cape
Cape
https://www.capesandbox.com/analysis/322571/

Comments


Avatar
zbet commented on 2022-10-22 07:45:22 UTC

url : hxxp://192.210.160.112/209/vbc.exe