MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 782df1aaa2744ba6a9efd5c9c05e16293e43a10093ab651866ceb009f977a9f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 782df1aaa2744ba6a9efd5c9c05e16293e43a10093ab651866ceb009f977a9f6
SHA3-384 hash: ceaeac74c004b580e0bef93507542f40fe70415751fbbbee15910c83ad5a717a9b548da6728134a4a9d73c832a309358
SHA1 hash: 022154fb249ccc2374a036b39bf8d35c4bf1a9f1
MD5 hash: c49c5f91e9dd8f31c04009734cefb78d
humanhash: double-xray-network-saturn
File name:PO 0060.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:503'600 bytes
First seen:2022-03-02 15:04:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 12288:o0G6xZyLMv+QgHfhyeksO82c3PqTuBM9qDC:LAMv+5HMZs1N/qTuAH
Threatray 11'198 similar samples on MalwareBazaar
TLSH T199B4BFD3B184959AD81117B3A477C83812A62FDC68B1C60D129AB7A76BF32C3514FF4E
File icon (PE):PE icon
dhash icon 00a2b28abadacac2 (1 x Formbook, 1 x AveMariaRAT)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/246341/
Detection(s):
SecuriteInfo.com.Trojan.Loader.938.32437.15474.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Searching for synchronization primitives
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll virus
Link:
https://www.filescan.io/uploads/621f87a60cd58dbd92636471/reports/ef67853c-6663-44d1-944a-062643911d75/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RaRansomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2a7e689b-4007-47bb-be29-110345cd5dfc
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/949267
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 581745 Sample: PO 0060.exe Startdate: 02/03/2022 Architecture: WINDOWS Score: 92 17 Found malware configuration 2->17 19 Malicious sample detected (through community Yara rule) 2->19 21 Antivirus detection for URL or domain 2->21 23 3 other signatures 2->23 7 PO 0060.exe 18 2->7         started        process3 file4 15 C:\Users\user\AppData\Local\Temp\hxaynh.exe, PE32 7->15 dropped 10 hxaynh.exe 7->10         started        process5 signatures6 25 Multi AV Scanner detection for dropped file 10->25 13 hxaynh.exe 10->13         started        process7
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/782df1aaa2744ba6a9efd5c9c05e16293e43a10093ab651866ceb009f977a9f6/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-02 09:35:33 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=paw7dkvcorf2nkpp2xe4axqwfe7ehiiasovwkgdgz2yat6lxvh3a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
13d4188437fd7caf662393052ef82808bf70cdb5e31fcc2f162ad2dffad377aa
Formbook
224f624a53eb1c209d1fc9161cb9d91464768960765e64855ccf547d0c64c478
Formbook
29e7d7eec0c8b07eac1b67b2875c1942104495e5e37f8b08fd788d4157376b1b
Formbook
5da3ef49a658c41da32f3258e3124c24e9641496ea1c2443d40c680a9f7b0e8c
Formbook
78626de6d56a42e31638f24a044d6082282e6f8d2d66ea2f5d4e65fe816a92ee
Formbook
83f6ae731d42e5b754955cc68e0289a7b30592e04121cbea6f51a90845c331dd
Formbook
a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e
Formbook
ff9c2a9f30d1de620b3b32389ea8efd1f624113ec22ff7055a416539cac2afac
Formbook
+ 11'188 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader campaign:sj8q loader persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220302-sf8zxahaal/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Adds policy Run key to start application
Executes dropped EXE
Xloader Payload
Formbook
Suspicious use of NtCreateProcessExOtherParentProcess
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Unpacked files
SH256 hash:
6d0548df967b7390cfd5bcf0969bd64a4f4f682053e64336b7f698c45e6efbb7
MD5 hash:
8112b6330d54935ca1c897b73c02d32a
SHA1 hash:
4de0774399802342d005f395a7fd0ed8a7ad3d46
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/644810f7-731d-4c4f-8852-70c923eb700b/
Parent samples :
83e2d139b07165c8ee6bb9253d4a1df920ee6cebaa0d5bd16723848dc0c5613b
782df1aaa2744ba6a9efd5c9c05e16293e43a10093ab651866ceb009f977a9f6
350f69de23d0f180b69a85ef2b3a09195ebb95ac525d09082504d955f63f59e1
c86f3a2110ed2a8498cf30d4ab88cf9ea18edc612835fe2b369e7596dafb802e
a2c0c62a11f867cff9fe7cd1b2597c9a7bb1c268e18e35289d6f7afdb2adbdbc
439db5f69b49091964c335c5977bc6dbf8aa41398d0240410dfeb898add7dace
934cdab74883aa6b38f53310f73ffd5b8c4a175fad14b9eb5c6873653242410b
SH256 hash:
27efd6c4d0bd1abc29cb306a4718ad82770bad7104ded332ffbf3feae98fac3e
MD5 hash:
f11b0b87b18c4027852abbf5215bbb8d
SHA1 hash:
584c087740847d269a37c1f83908533fcec68564
Link:
https://www.unpac.me/results/644810f7-731d-4c4f-8852-70c923eb700b/
SH256 hash:
782df1aaa2744ba6a9efd5c9c05e16293e43a10093ab651866ceb009f977a9f6
MD5 hash:
c49c5f91e9dd8f31c04009734cefb78d
SHA1 hash:
022154fb249ccc2374a036b39bf8d35c4bf1a9f1
Link:
https://www.unpac.me/results/644810f7-731d-4c4f-8852-70c923eb700b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/782df1aaa2744ba6a9efd5c9c05e16293e43a10093ab651866ceb009f977a9f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_Formbook_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/246341/

Comments