MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853
SHA3-384 hash: 06db8b3eb389ae39b50a0d73a0042231248ac602daae8e6f15bced099f3745dd6b591c5f556e833838f6cadcd08af843
SHA1 hash: e4b6476bbb722f0c6513284d827b9290d6056489
MD5 hash: f508abf920fbd52e54dba67bcfd561ba
humanhash: london-harry-montana-lake
File name:DHL Documents.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:907'776 bytes
First seen:2022-02-14 07:11:21 UTC
Last seen:2022-02-14 09:17:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:6qyd9G4LZ5fO7p9zgAAdsyyq4ZZsVoAc:8d9G4tA9gAAdsdq4HV/
Threatray 13'298 similar samples on MalwareBazaar
TLSH T146150209BBA3D901C5720BBAE8E11191AB74FE1E4117D7BF306D3A9D2FAB39A0531531
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/241279/
Detection(s):
SecuriteInfo.com.ArtemisF508ABF920FB.19341.18836.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Searching for synchronization primitives
Unauthorized injection to a system process
Gathering data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c0e627d0-78ff-452b-a420-7e1fae29e35b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/939159
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 571636 Sample: DHL Documents.exe Startdate: 14/02/2022 Architecture: WINDOWS Score: 100 32 www.onboardaltdigitalavg.rest 2->32 34 www.northernlightdebtrelief.com 2->34 36 3 other IPs or domains 2->36 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 8 other signatures 2->46 11 DHL Documents.exe 3 2->11         started        signatures3 process4 file5 30 C:\Users\user\...\DHL Documents.exe.log, ASCII 11->30 dropped 56 Injects a PE file into a foreign processes 11->56 15 DHL Documents.exe 11->15         started        signatures6 process7 signatures8 58 Modifies the context of a thread in another process (thread injection) 15->58 60 Maps a DLL or memory area into another process 15->60 62 Sample uses process hollowing technique 15->62 64 Queues an APC in another process (thread injection) 15->64 18 explorer.exe 15->18 injected process9 process10 20 chkdsk.exe 18->20         started        signatures11 48 Self deletion via cmd delete 20->48 50 Modifies the context of a thread in another process (thread injection) 20->50 52 Maps a DLL or memory area into another process 20->52 54 Tries to detect virtualization through RDTSC time measurements 20->54 23 explorer.exe 2 153 20->23         started        26 cmd.exe 1 20->26         started        process12 dnsIp13 38 192.168.2.1 unknown unknown 23->38 28 conhost.exe 26->28         started        process14
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-14 04:29:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oyjhi3ibz76dh6hwco2xx42yekvneitxzjwaohx6teg23ux3zbjq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
31168981af16e0fc209774a91e04e5aaf622cacbed12e970b7a35db0705174d6
Formbook
5de06778dd414ee2cc418f089914bb7a656ccf854a30a004d286599cda4c4013
Formbook
6893bbff4695dce3754071670e11d7e7d310ad196b57cdb41cd8c3cd7ea3d8f3
Formbook
7cbd8cc35b03d65491ad01b6a44b84dc047e6663189554201c24dbfbeb81473c
Formbook
b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f
Formbook
d2cc3484cdabe8305bf9afd35530ca1118ca2c308408dc7140c3a94b392b60bb
Formbook
e8e0f125d909bafae93f469222f2cfbcb30585e03825d8442c8934a92fdd6c89
Formbook
ff3f7736a06e89ae300270369d83b922423c8a840903b30a8a21365c4b0b0628
Formbook
+ 13'288 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:qr26 loader rat suricata
Link:
https://tria.ge/reports/220214-h1kspshggm/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
9e918369bbdee57f4c3c29b2b5ef1935d00d46474bbe5176910cc08cd34fd370
MD5 hash:
1f1bb2702e0fee67ed8ead628d07e1f3
SHA1 hash:
717f2ef88a637d84a6e86920d1ca6a88ae456e40
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/b7ccc0c0-780a-4bdc-8cbc-40c3016e665d/
Parent samples :
7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853
776233fa1eb951f0d8ea2d27b0da36048e6a17e1dabac5714074152ae68b8958
7d0f884df7b5cb377f196e56b59689a99e3e43637b7cda4e9482e31c74a625f3
1c5eb1ef71716f2a7498f3d8ee6d7aa936dac7cf4c4b920ec2c4ea8c90511824
SH256 hash:
ec7f114040751ff807a5eb875a4d7f2fcb4492fde61f93196073536674817b42
MD5 hash:
515205459bf79e526e058b6992ba212a
SHA1 hash:
e0d872ac5832e105d4f55eb3ccda9232881f9379
Link:
https://www.unpac.me/results/b7ccc0c0-780a-4bdc-8cbc-40c3016e665d/
SH256 hash:
3ca74eb4ce4c2c5604dc298949ae47996d93063abfde0682d689205561d17d44
MD5 hash:
4e35b541f3d9162d0ac93d336df67779
SHA1 hash:
bb9e65761186806d4bada659e9d5db0c070501d4
Link:
https://www.unpac.me/results/b7ccc0c0-780a-4bdc-8cbc-40c3016e665d/
SH256 hash:
4b723a441ac8d6e111e5a4014073dd92237f0a53c74607dbd3d57c43fb6e7371
MD5 hash:
66e4c5f93b1bc4b6d9c0558505f19472
SHA1 hash:
1da23aee64e7a1e1eb7e5e5597f92e83f05b2880
Link:
https://www.unpac.me/results/b7ccc0c0-780a-4bdc-8cbc-40c3016e665d/
SH256 hash:
7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853
MD5 hash:
f508abf920fbd52e54dba67bcfd561ba
SHA1 hash:
e4b6476bbb722f0c6513284d827b9290d6056489
Link:
https://www.unpac.me/results/b7ccc0c0-780a-4bdc-8cbc-40c3016e665d/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7612746d01cf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/241279/
  
URLhaus
https://urlhaus.abuse.ch/url/2043025/
  
Delivery method
Distributed via web download

Comments