MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 715e8885c06569189466a8c034e43370b745238756cda09f017c2c2fae52e84d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 715e8885c06569189466a8c034e43370b745238756cda09f017c2c2fae52e84d
SHA3-384 hash: c7395f9c9c91df39665f22ef1300e076da6e3569634c9373b294473a40be211fb36bd9d721dbef155e663a394db5198b
SHA1 hash: 1b69d27dfe2e4d34ed7d0db16638bcb87ca296b3
MD5 hash: 7cba2a6fb71317ba50994daf77fb4237
humanhash: winner-arkansas-west-coffee
File name:SOFTWARE LTD PO-09890.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'299'968 bytes
First seen:2021-12-13 16:41:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:ZfPMWFbggbqyG/xWiXOFqCzfojAF7A6VNlpKlWxtKSuzpKjLU:p7ggbq7/PvCd8IxESudKjLU
TLSH T1A0552347F6582B16D47C53FE2650466403B2550D6A33F1AE0DDAE8C72BD87428B2EBE3
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOFTWARE LTD PO-09890.exe
Verdict:
Malicious activity
Analysis date:
2021-12-13 17:38:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a1b09f49-cf78-4089-b81c-a78cda9350a0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/213612/
Detection(s):
PUA.Win.Packer.Medvedev-6482674-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
Searching for synchronization primitives
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61b777e32a06937266112f5f/reports/448dc862-76a4-4310-9e5e-67c8e3d99aac/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/41193108-164b-470a-924e-bb037e6f37d4
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/906511
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 538989 Sample: SOFTWARE LTD PO-09890.exe Startdate: 13/12/2021 Architecture: WINDOWS Score: 100 30 www.bxbcustoms.com 2->30 32 bxbcustoms.com 2->32 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Yara detected AntiVM3 2->42 44 6 other signatures 2->44 11 SOFTWARE LTD PO-09890.exe 3 2->11         started        signatures3 process4 signatures5 56 Injects a PE file into a foreign processes 11->56 14 SOFTWARE LTD PO-09890.exe 11->14         started        17 SOFTWARE LTD PO-09890.exe 11->17         started        process6 signatures7 58 Modifies the context of a thread in another process (thread injection) 14->58 60 Maps a DLL or memory area into another process 14->60 62 Sample uses process hollowing technique 14->62 64 Queues an APC in another process (thread injection) 14->64 19 explorer.exe 14->19 injected process8 dnsIp9 34 www.mirchana.com 141.125.107.194, 49810, 80 SOFTLAYERUS United States 19->34 36 www.lgkfs.xyz 19->36 46 System process connects to network (likely due to code injection or exploit) 19->46 48 Performs DNS queries to domains with low reputation 19->48 23 msiexec.exe 19->23         started        signatures10 process11 signatures12 50 Self deletion via cmd delete 23->50 52 Modifies the context of a thread in another process (thread injection) 23->52 54 Maps a DLL or memory area into another process 23->54 26 cmd.exe 1 23->26         started        process13 process14 28 conhost.exe 26->28         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/715e8885c06569189466a8c034e43370b745238756cda09f017c2c2fae52e84d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-13 16:42:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ofpirboamvurrfdgvdadjzbtoc3uki4hk3g2bhybpqwc7lss5bgq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:s11o rat spyware stealer trojan
Link:
https://tria.ge/reports/211213-t7n99adhc3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.xn--diegovariados-zeb.online/s11o/
Unpacked files
SH256 hash:
618dbf809af2648119f571f1b8c6ef221a22c5bdf729a623222b7814570bd8d1
MD5 hash:
fc16ab0e499fb208c34f477c5c40de27
SHA1 hash:
15d461202f5fb91c18c33889706bd8f128e60a8a
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/e9e7bf91-bb05-47cb-b7d8-79b0deed5a17/
Parent samples :
715e8885c06569189466a8c034e43370b745238756cda09f017c2c2fae52e84d
8aded772f5733ae6cd66163868e0fc5dac4e3fe4cca89b3e539149615beaa1b8
SH256 hash:
f1ce394adcd1d493c69057568aeac889a36a1a66bf5e8aac4f5bfed099054204
MD5 hash:
88e9de5b036f9513a7cc317b1537d929
SHA1 hash:
9afa7f34ead820e81846da894e655909e013b52e
Link:
https://www.unpac.me/results/e9e7bf91-bb05-47cb-b7d8-79b0deed5a17/
SH256 hash:
219c650c2b1960fc5775630e65c09e572e2d7738ab53a9666fd128ae6eb6cbb7
MD5 hash:
f723db9e14005dcfff10cf192b282cf7
SHA1 hash:
55734c2bfb0e2c88b9a7738189aa2fe3c1f93459
Link:
https://www.unpac.me/results/e9e7bf91-bb05-47cb-b7d8-79b0deed5a17/
SH256 hash:
715e8885c06569189466a8c034e43370b745238756cda09f017c2c2fae52e84d
MD5 hash:
7cba2a6fb71317ba50994daf77fb4237
SHA1 hash:
1b69d27dfe2e4d34ed7d0db16638bcb87ca296b3
Link:
https://www.unpac.me/results/e9e7bf91-bb05-47cb-b7d8-79b0deed5a17/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/715e8885c065/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/715e8885c06569189466a8c034e43370b745238756cda09f017c2c2fae52e84d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/213612/

Comments