MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7170c963a4346f0a02064d746ef54115dd36da7c5fbadcf024d58533df0ba806. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7170c963a4346f0a02064d746ef54115dd36da7c5fbadcf024d58533df0ba806
SHA3-384 hash: 376911f8010816a721e81e51887251012ff6d4752fa308a7d2a176d2e16ad7b93f5b18700cf43aa3b2808d428250fa7b
SHA1 hash: 6f0e951b567334bf82cc49c8dfc2e9218d387bc3
MD5 hash: be682c03e6d870c131832a40a2abf641
humanhash: hot-west-mars-eleven
File name:Invoice & Packing List..exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'304'576 bytes
First seen:2021-08-26 14:24:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:kziWIuraaXterNDEkfzFDNBqUHm0io0MiWV/Nm/y12NhmE:kRIwaaaNJNNBqUHOoKyYF
Threatray 8'410 similar samples on MalwareBazaar
TLSH T10855053C29BD222BD2B9C7B9CBE58827F05499AF3111AD6458D3576A4B13E4235C323F
dhash icon 1834b436f2f0f0c2 (10 x AgentTesla, 7 x Formbook, 5 x SnakeKeylogger)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
363
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Invoice & Packing List..exe
Verdict:
Malicious activity
Analysis date:
2021-08-26 14:26:05 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/0d1809d5-f868-4695-ad5e-94bab3e98d3d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/182684/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1011.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ff15ce6a-ba6f-4f9e-8794-fc94bdb3572c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/839836
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Process Start Without DLL
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 472269 Sample: Invoice & Packing List..exe Startdate: 26/08/2021 Architecture: WINDOWS Score: 100 36 www.thejbnails.com 2->36 38 www.giulz.com 2->38 40 ext-sq.squarespace.com 2->40 46 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 12 other signatures 2->52 11 Invoice & Packing List..exe 3 2->11         started        signatures3 process4 file5 28 C:\Users\...\Invoice & Packing List..exe.log, ASCII 11->28 dropped 14 Invoice & Packing List..exe 11->14         started        process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 14->60 62 Maps a DLL or memory area into another process 14->62 64 Sample uses process hollowing technique 14->64 66 Queues an APC in another process (thread injection) 14->66 17 explorer.exe 14->17 injected process8 dnsIp9 30 beststrategyforsellers.com 75.126.14.162, 49741, 80 SOFTLAYERUS United States 17->30 32 facilmkt.com 145.239.189.1, 49736, 80 OVHFR France 17->32 34 11 other IPs or domains 17->34 42 System process connects to network (likely due to code injection or exploit) 17->42 44 Performs DNS queries to domains with low reputation 17->44 21 rundll32.exe 17->21         started        signatures10 process11 signatures12 54 Modifies the context of a thread in another process (thread injection) 21->54 56 Maps a DLL or memory area into another process 21->56 58 Tries to detect virtualization through RDTSC time measurements 21->58 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7170c963a4346f0a02064d746ef54115dd36da7c5fbadcf024d58533df0ba806/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-26 10:05:40 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ofymsy5egrxquaqgjv2g55kbcxotnwt4l65nz4be2wcthxylvada._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02f219e86791727efbc7d24273381485d1843ec9d85fa2d6fbd902d8e7c2fa12
Formbook
47add606e2f5ed4596bffd9f0345e35164c80071efbb0dc4e7b29d1d62391a6e
Formbook
4c6e43c5746182cb3cf7e928fda456101b27c8c4d277658540912500d4b06239
Formbook
8b520ce0de0ae8276e9c19053cae465454c94c963834166cfe5b2eb43f6050e4
Formbook
9001d75f0d0b09af013fc65992e74d4b568d166ca5837f1bf52316173b3f30d2
Formbook
b55552391ee123f26e577b412c0df78bd0a59644ec510d1e7e708feff12a2abb
Formbook
b6a58224bb0fbca5d4a297bdc2237ffd671e5548ebd6d35434ae1196df97f8d9
Formbook
dc5f7d89ab2465597ff7fa9f544326613aeaab2afa6e2e457ba5fc0da15bd450
Formbook
f782375e80f3a68b36457886ac1c6490e2497e6c9fb3ffdb33c1679597f0770e
Formbook
+ 8'400 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:o9pi loader rat
Link:
https://tria.ge/reports/210826-jfbfnzstjs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.triplerb.net/o9pi/
Unpacked files
SH256 hash:
8b4698511df97b0953e53ccc469f466a58d87446291c1a4d781d4d449d3c9f66
MD5 hash:
8cf3cb6cd68bc82f1b01f315d420e71c
SHA1 hash:
a5039fd57339cfca96ad64436d3d712c72aed5ad
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/ffab5448-85f8-401a-a1c0-268908d94654/
Parent samples :
8b520ce0de0ae8276e9c19053cae465454c94c963834166cfe5b2eb43f6050e4
7170c963a4346f0a02064d746ef54115dd36da7c5fbadcf024d58533df0ba806
SH256 hash:
c0ee1071e444f415f8b62856a0896f3b22e563f1bb4f03d14142583efe49a565
MD5 hash:
29db2e114b88ae1f6a00c9aa71690043
SHA1 hash:
ec82db71443556a5b320357b0b8b09e70ec1db9c
Link:
https://www.unpac.me/results/ffab5448-85f8-401a-a1c0-268908d94654/
SH256 hash:
66a82b040643bd0cedd082763331ef871de9e1d518da8677c5638dd723766ee3
MD5 hash:
ab8f173a54e7f12c1e73bb31f3d21adf
SHA1 hash:
e49c7d50ee771600ba3726f70f41efaa90d8ccd6
Link:
https://www.unpac.me/results/ffab5448-85f8-401a-a1c0-268908d94654/
SH256 hash:
7170c963a4346f0a02064d746ef54115dd36da7c5fbadcf024d58533df0ba806
MD5 hash:
be682c03e6d870c131832a40a2abf641
SHA1 hash:
6f0e951b567334bf82cc49c8dfc2e9218d387bc3
Link:
https://www.unpac.me/results/ffab5448-85f8-401a-a1c0-268908d94654/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/7170c963a4346f0a02064d746ef54115dd36da7c5fbadcf024d58533df0ba806

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 7170c963a4346f0a02064d746ef54115dd36da7c5fbadcf024d58533df0ba806

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/182684/

Comments