MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161
SHA3-384 hash: 34f37d12d9ef9b7a40c3dbf30bf49f230885fad8f0e454437705360eca53f93069debb9f073718fa6b434e8d36fce5fb
SHA1 hash: eb8e2217c6b667102c31d47bacb88a95e25f4a9b
MD5 hash: 4169f0ada3f069e2fa0dbf561820d4b0
humanhash: pluto-tennessee-august-stairway
File name:DHL Shipment Delivery Waybill No 10020202810.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:871'936 bytes
First seen:2020-09-28 13:50:09 UTC
Last seen:2020-09-28 14:46:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ccd477c88c3e8be26b5e0692515f665c (4 x AgentTesla, 1 x Loki, 1 x Formbook)
ssdeep 12288:y38ZC2jTIBwgM9poZThtKyx12lwLxog3rChBQhwIRP17YppIkNVnfnwhEgtY9:IfzBw3PotKWR9h3On6t10ppRNQt
Threatray 2'296 similar samples on MalwareBazaar
TLSH D505AF36B1A15833C123E57C9C0B57B4AC26BA503A2879862BF5DC7C5F3F691382A1D7
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/66435/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/476446
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 290673 Sample: DHL Shipment Delivery Waybi... Startdate: 28/09/2020 Architecture: WINDOWS Score: 100 34 www.willow-and-hill.com 2->34 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 Detected unpacking (changes PE section rights) 2->42 44 6 other signatures 2->44 11 DHL Shipment Delivery Waybill No 10020202810.exe 2->11         started        signatures3 process4 signatures5 52 Maps a DLL or memory area into another process 11->52 14 DHL Shipment Delivery Waybill No 10020202810.exe 11->14         started        process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 Queues an APC in another process (thread injection) 14->60 17 explorer.exe 14->17 injected process8 dnsIp9 28 www.lamapromo.com 204.11.56.48, 49723, 80 CONFLUENCE-NETWORK-INCVG Virgin Islands (BRITISH) 17->28 30 totalgccs.com 209.205.200.90, 49724, 80 24SHELLSUS United States 17->30 32 4 other IPs or domains 17->32 36 System process connects to network (likely due to code injection or exploit) 17->36 21 WWAHost.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-09-27 15:23:56 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpleh5prp5pgehxsfzgaljozfrizg5wqaq6aswbiju2k4idmafqq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
netwirerc
Create hunting rule
Similar samples:
15af9bb36b7a51efea7ab70d98a29ef7059f4f5b7178fef0aaff0671bf6c9386
Formbook
17de42648d49e21ed411c460fa0c805443e1898e21114beb8ea7301da3ee6b31
Formbook
34eeebc4197df0980b621253c336662f3868ccc65a5f99a832d47751d4d5384e
Formbook
54c0138d6a0dbd5967d7cf51eb753b29aa1fd72a85152285bd22347fa6654022
Formbook
8aafecddd3b462d27c24000757496edb5c6bce1e6abff9157d5360457b0805d7
Formbook
a05ae5c56a5a5c24f2c7276f2c669cb33c09f87d75a09030b094f12a4a1a17fa
Formbook
ad660d774f78137622d038976557c8782211dbfd39d2ff9a7a4bcc9279ba0f41
Formbook
b2a437bec36856a90558f9f54873096e6d1324cf487cc265038dbe82e5b03788
Formbook
cddef48cbafa5561f43fd788cfc08215af2c8c4d700bbad363c467e60ad0eda1
Formbook
f44cd8c2df04f8921d2d50831c0268b93d48fb0a149c3783331adaec733a47ed
Formbook
+ 2'286 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200928-ncdzkvef5n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.pilgrimfriend.com/nm8/
Unpacked files
SH256 hash:
63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161
MD5 hash:
4169f0ada3f069e2fa0dbf561820d4b0
SHA1 hash:
eb8e2217c6b667102c31d47bacb88a95e25f4a9b
Link:
https://www.unpac.me/results/69f70386-1c73-4c3a-b151-e1ad120d3893/
SH256 hash:
4950519ad44c27ef1ddda43b0282680b8e2ca973dc9dbe117207d2f5e5e8008b
MD5 hash:
d22012e5ae31b89f865d40645561567f
SHA1 hash:
f18be00f07c1d28198bee8460cc991ea4671cea4
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/69f70386-1c73-4c3a-b151-e1ad120d3893/
Parent samples :
63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161
5c0c2689256894521ac0012bc464ad7e0d93c25c60b9df3dfe26b35d85d1713a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/66435/

Comments