MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242
SHA3-384 hash: 13b8f12746be52d5bbc491909098665763af292ea426ca840d815277c4096b5b696bddc4d8a4ea27d570ca1d179f28cb
SHA1 hash: 98aa2e6b6c0698e0a4a439c94b80550b7ebad2d4
MD5 hash: 69fcac13980b13199f56841fb1e0e0b1
humanhash: pizza-quiet-carpet-music
File name:IM2201-2T,pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:542'720 bytes
First seen:2022-02-14 14:53:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:n6brWDkvqrZMXptfwMO5MXzmuc0bGmIvjO:q6DkvqrctQOXquc06m6jO
Threatray 13'440 similar samples on MalwareBazaar
TLSH T144B48D01B1859C9AE41316B268BFD7202169AF9D9176C50E3647BF3B49F3313346BB8E
File icon (PE):PE icon
dhash icon b2b28c969aaa8e86 (2 x Formbook)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/241390/
Detection(s):
SecuriteInfo.com.Heur.MSIL.Androm.1.15494.15719.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Launching a process
Creating a file
Сreating synchronization primitives
Launching cmd.exe command interpreter
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/620a6d0d289e2f3e4fd97ee0/reports/33993638-6f50-4a77-ab56-157c1c76d5f8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4ad12fd9-54f9-45ef-80ad-91b21dccff9a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/939447
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 571923 Sample: IM2201-2T,pdf.exe Startdate: 14/02/2022 Architecture: WINDOWS Score: 100 39 www.uwuplay.com 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus detection for URL or domain 2->45 47 10 other signatures 2->47 11 IM2201-2T,pdf.exe 5 2->11         started        signatures3 process4 file5 33 C:\Users\user\...\Creative_Cloud_Set-Up.exe, PE32 11->33 dropped 35 Creative_Cloud_Set...exe:Zone.Identifier, ASCII 11->35 dropped 37 C:\Users\user\...\IM2201-2T,pdf.exe.log, ASCII 11->37 dropped 55 Creates an undocumented autostart registry key 11->55 57 Writes to foreign memory regions 11->57 59 Allocates memory in foreign processes 11->59 61 2 other signatures 11->61 15 MSBuild.exe 11->15         started        18 MSBuild.exe 11->18         started        20 conhost.exe 11->20         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 22 explorer.exe 15->22 injected 71 Tries to detect virtualization through RDTSC time measurements 18->71 process9 process10 24 systray.exe 22->24         started        signatures11 49 Modifies the context of a thread in another process (thread injection) 24->49 51 Maps a DLL or memory area into another process 24->51 53 Tries to detect virtualization through RDTSC time measurements 24->53 27 cmd.exe 1 24->27         started        29 explorer.exe 1 153 24->29         started        process12 process13 31 conhost.exe 27->31         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-14 14:54:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lxpgocj3reo7fbxjtciskv72lghl5pdgfozqeux35hhhpghfajba._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3a1b706adecf798ffa11002e153bad33e9f82e6a9da82f7777c27d2cf7b23b0d
Formbook
3c3ef93ea804d5d80ecbdb244ddf7fe2ab657f54089a397f0c79d89dfef5c95c
Formbook
79215526b0229696bf3961e09918bca444cb43b079ca70834c54db52c49c51ac
Formbook
7cbd8cc35b03d65491ad01b6a44b84dc047e6663189554201c24dbfbeb81473c
Formbook
b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f
Formbook
b972dfd3f5fd6142b67366d223c0056b75d3d93538a7c05ce35e27ad1c9541ed
Formbook
dbc4b30858a2fa9f7001f2347e1cb88f660b8e6651962519b78a7978c6cc2d72
Formbook
+ 13'430 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:ahge loader rat suricata
Link:
https://tria.ge/reports/220214-r9we8sahgl/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
e4a685e4c3109145005efaddda7812de342ebc1075c6d71ccbc70fa13bb9c66b
MD5 hash:
154cb0736fe47a8539202073188df0e5
SHA1 hash:
707bbfa09e23b66ec2ebec66cb660565872c7388
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/818e3101-5adc-4788-8300-a56524876853/
Parent samples :
5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242
9767d52eebfbf17f2e549a57d68d7f11c199af327eeb20542b39485f883f61e1
SH256 hash:
1fc7e7f2f744207f25120a1c38c238e03d5e379bbcc61014da6422983ef11bdf
MD5 hash:
e0e93561afd2551ef5b0404d1a311edc
SHA1 hash:
f76f3f358122a000cf78959f8320d5a88ad711da
Link:
https://www.unpac.me/results/818e3101-5adc-4788-8300-a56524876853/
SH256 hash:
2b88ea89f2a151e33bc98ad83f5eafce4c38630cf8de76670024b651e1fedd00
MD5 hash:
10d0a7187256a426dc4f73f7898088b5
SHA1 hash:
3f43df2a6434558fbe993d23a1c962222e843cb3
Link:
https://www.unpac.me/results/818e3101-5adc-4788-8300-a56524876853/
SH256 hash:
5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242
MD5 hash:
69fcac13980b13199f56841fb1e0e0b1
SHA1 hash:
98aa2e6b6c0698e0a4a439c94b80550b7ebad2d4
Link:
https://www.unpac.me/results/818e3101-5adc-4788-8300-a56524876853/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5dde67093b89/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242

(this sample)

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/241390/

Comments