MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5898ff655531cce98050d6ac064d14b5e64249c3e8a01110e12b46e93bf72de9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5898ff655531cce98050d6ac064d14b5e64249c3e8a01110e12b46e93bf72de9
SHA3-384 hash: 7a1b8c59729903ed6aaf59ad1bd41ac59e30fb35c12f8369391f5dde6b0d6e21a6eb30eb1ce7e7fc2c81087e6225c295
SHA1 hash: 297d8d7a7c8524914d78892e51fe92b034c47bc1
MD5 hash: f70df4cd6c3bb5f98021586d550d47d7
humanhash: bulldog-equal-island-july
File name:dhlexcel9078.excel.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:473'379 bytes
First seen:2021-10-25 11:01:12 UTC
Last seen:2021-10-25 12:18:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:FBlL/yX8LPciLaYcCfWI3YBFt7WhUEC5uzp3NibXEx8af1095ZFKdyvo7M0M:TT6ChQ7WC5ul3NibXEx8d95/K84pM
Threatray 10'826 similar samples on MalwareBazaar
TLSH T193A4BF90D8847166D4294777D42BFE22481F1FB59572242B5398FDA2323F8C72B37A2B
File icon (PE):PE icon
dhash icon 03f5494d69496f3e (1 x Formbook)
Reporter malwarelabnet
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
212
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/199878/
Detection(s):
SecuriteInfo.com.Zum.Androm.1.23989.16459.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6176a3a2db358dd15ed932ba/reports/fee016ef-87bf-473f-9067-465dbd058ea1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4eb66da7-a138-440a-8725-25ec7742bdc3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/876203
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 508632 Sample: dhlexcel9078.excel.exe Startdate: 25/10/2021 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->36 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 5 other signatures 2->42 10 dhlexcel9078.excel.exe 17 2->10         started        process3 file4 28 C:\Users\user\AppData\Local\...\czzinqps.dll, PE32 10->28 dropped 54 Detected unpacking (changes PE section rights) 10->54 56 Tries to detect virtualization through RDTSC time measurements 10->56 58 Injects a PE file into a foreign processes 10->58 14 dhlexcel9078.excel.exe 10->14         started        signatures5 process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 14->60 62 Maps a DLL or memory area into another process 14->62 64 Sample uses process hollowing technique 14->64 66 Queues an APC in another process (thread injection) 14->66 17 explorer.exe 14->17 injected process8 dnsIp9 30 www.kitsusimplex.com 180.215.57.167, 49827, 80 BCPL-SGBGPNETGlobalASNSG Singapore 17->30 32 www.qatarstyleart.com 62.60.244.187, 49829, 80 ASLINE-AS-APASLINELIMITEDHK Iran (ISLAMIC Republic Of) 17->32 34 www.xoarin.online 66.29.151.197, 49812, 80 ADVANTAGECOMUS United States 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 explorer.exe 17->21         started        signatures10 process11 signatures12 46 Self deletion via cmd delete 21->46 48 Modifies the context of a thread in another process (thread injection) 21->48 50 Maps a DLL or memory area into another process 21->50 52 Tries to detect virtualization through RDTSC time measurements 21->52 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5898ff655531cce98050d6ac064d14b5e64249c3e8a01110e12b46e93bf72de9/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-25 10:59:47 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcmp6zkvghgotacq22wamtiuwxteesod5cqbcehbfndoso7xfxuq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
5ab3abbaaa772885b083fd8bd8d5855e8c6578c4a7cbaeef2cf68c1a3f4c1e11
Formbook
5fd22c8bf1e7e06ccaa6ebc23410086fe0e3bc30b1613cd6ee734f280c0d6979
Formbook
694b9ea09a47c2f24b47c60ddff0a0537828e8ba964c0ad0045b9862bce37d42
Formbook
85601ede72b1c348db5663e3782e7b3f3157c2356e2c90b769bb2afc2d476e4c
Formbook
b66060a214c372ff66b8917fee39b5cb6c82972cf7cdfcd64b9ae4b7b7e01bf7
Formbook
bb6c08035fd7dc06d3ace7952af7bd640c45c548e087dba1deaa45f1861b0077
Formbook
d6a8c5f4120e3be2e6d676d808dbdadc074f811398ac5b03878baba7275137d4
Formbook
e14df53adff2889344d4502133a00a389e06039715c26a7724ed3f046fc683a1
Formbook
fedeb19031bcc0941b0943dd3ed45ee6095b8c489c072c85e513b414abf8acf5
Formbook
+ 10'816 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ct6s rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/211025-m45dqsgheq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.metalzj.quest/ct6s/
Unpacked files
SH256 hash:
5898ff655531cce98050d6ac064d14b5e64249c3e8a01110e12b46e93bf72de9
MD5 hash:
f70df4cd6c3bb5f98021586d550d47d7
SHA1 hash:
297d8d7a7c8524914d78892e51fe92b034c47bc1
Link:
https://www.unpac.me/results/2c9b066e-0068-4e9e-aa8f-c948056528e5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5898ff655531cce98050d6ac064d14b5e64249c3e8a01110e12b46e93bf72de9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/199878/

Comments