MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c0c2689256894521ac0012bc464ad7e0d93c25c60b9df3dfe26b35d85d1713a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c0c2689256894521ac0012bc464ad7e0d93c25c60b9df3dfe26b35d85d1713a
SHA3-384 hash: 954ebe044eb9d821d7f979be0727d65341922ff5a5e752871564b4c2958dc6d84e231c2e18f75d85b34b0caf15926081
SHA1 hash: 68743f2831f46695fe870745dd490643fcfa73d7
MD5 hash: b38692f1bb85112b7d93d38d36cd686a
humanhash: lactose-march-eight-cold
File name:DHL Express Courier Shipment Confirmation AWB618-76731333.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:791'552 bytes
First seen:2020-10-06 13:16:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 41cd3d95714b0df8060323fdc67b3eba (10 x AgentTesla, 6 x Loki, 1 x MassLogger)
ssdeep 12288:EcAt9L2fndhBK2w3p3z+iqiBZdMuWD9gP98Z+YKBE+DHEaUe:CHqhBFgBg6He+DEVe
Threatray 2'343 similar samples on MalwareBazaar
TLSH F6F49E22A2F14833C1671A3D9DDB6774ED25BE503E28A9463BE4DDCC5F396813819393
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68585/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Sending a UDP request
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/482769
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 293822 Sample: DHL Express Courier Shipmen... Startdate: 06/10/2020 Architecture: WINDOWS Score: 100 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Detected unpacking (changes PE section rights) 2->39 41 5 other signatures 2->41 10 DHL Express Courier Shipment Confirmation AWB618-76731333.exe 2->10         started        process3 signatures4 49 Maps a DLL or memory area into another process 10->49 13 DHL Express Courier Shipment Confirmation AWB618-76731333.exe 10->13         started        process5 signatures6 51 Modifies the context of a thread in another process (thread injection) 13->51 53 Maps a DLL or memory area into another process 13->53 55 Sample uses process hollowing technique 13->55 57 Queues an APC in another process (thread injection) 13->57 16 explorer.exe 13->16 injected process7 dnsIp8 27 ghs.googlehosted.com 172.217.168.83, 49766, 80 GOOGLEUS United States 16->27 29 www.ximoq.com 16->29 31 4 other IPs or domains 16->31 33 System process connects to network (likely due to code injection or exploit) 16->33 20 msiexec.exe 16->20         started        signatures9 process10 signatures11 43 Modifies the context of a thread in another process (thread injection) 20->43 45 Maps a DLL or memory area into another process 20->45 47 Tries to detect virtualization through RDTSC time measurements 20->47 23 cmd.exe 1 20->23         started        process12 process13 25 conhost.exe 23->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c0c2689256894521ac0012bc464ad7e0d93c25c60b9df3dfe26b35d85d1713a/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 11:58:28 UTC
File Type:
PE (Exe)
Extracted files:
74
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lqgcncjfnckfegwaaev4izfnpygzhqs4mc456pp6e2zv3boroe5a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
netwirerc
Create hunting rule
Similar samples:
63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161
Formbook
82f4ebd30b18743d8cc409de5931a978434755705af9bbfa3c6d8d0b34d30a6b
Formbook
89bf15eae14f60d6acc308cead31f09459947626b9839bbbddbf76f00821fe3b
Formbook
9107a8988792e1ec695a1d662a6b0f7668a6fbfb6352897c1f5bfe85addf2994
Formbook
ad660d774f78137622d038976557c8782211dbfd39d2ff9a7a4bcc9279ba0f41
Formbook
b2a437bec36856a90558f9f54873096e6d1324cf487cc265038dbe82e5b03788
Formbook
c6232f818d7c848dee9a6a653df75e0174e38362ff2e5f6040c5e7418af5f219
Formbook
c65fe5438e02a697fa15a0c17e76885ffb3a22eb92d47359f0519196d8b9c104
Formbook
cddef48cbafa5561f43fd788cfc08215af2c8c4d700bbad363c467e60ad0eda1
Formbook
d7d1d6057e7e731b75e1ba9579ccfe717334cc7b4f59324af1a0aa179db22e68
Formbook
+ 2'333 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/201006-ahcswm4aae/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.pilgrimfriend.com/nm8/
Unpacked files
SH256 hash:
4950519ad44c27ef1ddda43b0282680b8e2ca973dc9dbe117207d2f5e5e8008b
MD5 hash:
d22012e5ae31b89f865d40645561567f
SHA1 hash:
f18be00f07c1d28198bee8460cc991ea4671cea4
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/e93572df-45be-4d50-92c3-cf5e2385aead/
Parent samples :
63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161
5c0c2689256894521ac0012bc464ad7e0d93c25c60b9df3dfe26b35d85d1713a
SH256 hash:
5c0c2689256894521ac0012bc464ad7e0d93c25c60b9df3dfe26b35d85d1713a
MD5 hash:
b38692f1bb85112b7d93d38d36cd686a
SHA1 hash:
68743f2831f46695fe870745dd490643fcfa73d7
Link:
https://www.unpac.me/results/e93572df-45be-4d50-92c3-cf5e2385aead/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c0c2689256894521ac0012bc464ad7e0d93c25c60b9df3dfe26b35d85d1713a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/68585/

Comments