MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fe042e93ace8e9e3ac6c6b4f14847addc613c3c710a3e2bb63d36e4e188ec72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fe042e93ace8e9e3ac6c6b4f14847addc613c3c710a3e2bb63d36e4e188ec72
SHA3-384 hash: 4c7a520d75e77d458f5db58dc544a8aebcfcd87d6284f8fbddfb8c9b728a48e662171a24fb5b5f75ec45c1ebddab9bc3
SHA1 hash: 5361da7e6f3d85285048b3a82f33f0d74309dcfd
MD5 hash: 234a9557e370d3d750070b64808b0426
humanhash: spaghetti-texas-stairway-pennsylvania
File name:ORDER.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:751'616 bytes
First seen:2021-08-09 09:10:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:MXqv2J82iNeHK7zEIT4IVQG//+Vv2lIewZPVV8b8b9c9GZrZ4eB5eUZ7/:MXqv31b5yGzl32PVCbK9c9GlCeB5eUZ7
Threatray 7'528 similar samples on MalwareBazaar
TLSH T102F4022276D89706F67E2B7A14B0610203F5F849E733DD5E6DD524AD0E5BF8082B2B27
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ORDER.exe
Verdict:
Malicious activity
Analysis date:
2021-08-09 09:16:04 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/1c9dbf9b-2c0d-4ce3-b1be-a1d640ec1ab8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/177493/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Creating a file
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a7979c26-b231-4cbb-8600-935d2722271e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/829173
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Process Start Without DLL
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 461604 Sample: ORDER.exe Startdate: 09/08/2021 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 10 other signatures 2->49 9 ORDER.exe 4 2->9         started        process3 signatures4 51 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->51 53 Adds a directory exclusion to Windows Defender 9->53 55 Tries to detect virtualization through RDTSC time measurements 9->55 12 ORDER.exe 9->12         started        15 powershell.exe 26 9->15         started        process5 signatures6 57 Modifies the context of a thread in another process (thread injection) 12->57 59 Maps a DLL or memory area into another process 12->59 61 Sample uses process hollowing technique 12->61 63 Queues an APC in another process (thread injection) 12->63 17 rundll32.exe 12->17         started        20 explorer.exe 12->20 injected 23 conhost.exe 15->23         started        process7 dnsIp8 35 Modifies the context of a thread in another process (thread injection) 17->35 37 Maps a DLL or memory area into another process 17->37 39 Tries to detect virtualization through RDTSC time measurements 17->39 25 cmd.exe 1 17->25         started        29 www.forex160.com 168.206.153.175, 49744, 80 CLAYERLIMITED-AS-APClayerLimitedHK South Africa 20->29 31 www.resmipkv.com 20->31 33 parkingpage.namecheap.com 198.54.117.217, 49742, 80 NAMECHEAP-NETUS United States 20->33 41 System process connects to network (likely due to code injection or exploit) 20->41 signatures9 process10 process11 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7fe042e93ace8e9e3ac6c6b4f14847addc613c3c710a3e2bb63d36e4e188ec72/
Threat name:
ByteCode-MSIL.Worm.LovGate
Create hunting rule
Status:
Malicious
First seen:
2021-08-09 09:11:05 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7qef2j2z2hj4owgy22pcschvxogcpb4oefd4k5whu3ojymi5rza._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0119464081f8d755756760500cf89e722a10fdb5fedcd3fc9a7751b8cebeea55
Formbook
05c721de03dbe651feaf7322045cbfe600ce28e68e0497bec94c927ccc4d6a86
Formbook
28c834cf56663a83f9344840d232064cddf4fc6bab31178abaec6146a924f9f5
Formbook
2c47578888771c1f957517acf60459359b4e31938545f73c872dde24138171b1
Formbook
534d8b4992d534bc90055bab8ad3f479f29d613d573a42cf7e136dd84153b48b
Formbook
6b0f6ed4f13b5d6c7b973bd22941de1535ae580960940656b671f3b991c972a6
Formbook
8943af6c4da94f93c169ef98a7b8393ca92b01753e89ea5503d5740bcc45296d
Formbook
98f8f84dbf9e3a4462066c94e447ba3bdc6bc3d0119511e8c6d6cea0234f885c
Formbook
caae480439293c7be6bb9ca27621f5b99c7391d6b7fddc179d5f5627c6144d08
Formbook
+ 7'518 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:iesm evasion rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/210809-kgzgzfm1l2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Deletes itself
Looks for VMWare Tools registry key
Formbook Payload
Looks for VirtualBox Guest Additions in registry
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.htmlemailrepair.com/iesm/
Unpacked files
SH256 hash:
0aaf0c8bf0c2260d5a46a81661b83ff7992d07436f2e6dd1430702f40cde34ef
MD5 hash:
84b272b822f3b0b01c4e8ef020b89d01
SHA1 hash:
71905be10bf525bc948f9803470403767461e6bd
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/fe70e4e5-5165-496c-b43b-3494dce0a78d/
Parent samples :
6b0f6ed4f13b5d6c7b973bd22941de1535ae580960940656b671f3b991c972a6
2c47578888771c1f957517acf60459359b4e31938545f73c872dde24138171b1
7fe042e93ace8e9e3ac6c6b4f14847addc613c3c710a3e2bb63d36e4e188ec72
1f8c4b0bdfb68f353324fff65e4c97104d65d1f7f1bdf2202781c0a6a9dd3137
SH256 hash:
ed0dd1e2260da7b03c8b80e0b45e8fef44be722c1e8c41e078c1a25ed0d18ecc
MD5 hash:
6057ce35bd926dd6d49dedfa9cc18372
SHA1 hash:
1f4e44e1740ffbd91129ac3a37d22845bc52c158
Link:
https://www.unpac.me/results/fe70e4e5-5165-496c-b43b-3494dce0a78d/
SH256 hash:
088c337c49e87310b903c75520c38f9d698fb8e065063bc23a233fdd394c6054
MD5 hash:
2f871ab1784e5d55379d590ea064e654
SHA1 hash:
15b2396d48f2ba77ea18c035070a8358cb025b09
Link:
https://www.unpac.me/results/fe70e4e5-5165-496c-b43b-3494dce0a78d/
SH256 hash:
7fe042e93ace8e9e3ac6c6b4f14847addc613c3c710a3e2bb63d36e4e188ec72
MD5 hash:
234a9557e370d3d750070b64808b0426
SHA1 hash:
5361da7e6f3d85285048b3a82f33f0d74309dcfd
Link:
https://www.unpac.me/results/fe70e4e5-5165-496c-b43b-3494dce0a78d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7fe042e93ace/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7fe042e93ace8e9e3ac6c6b4f14847addc613c3c710a3e2bb63d36e4e188ec72

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/177493/

Comments