MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81fc763d0863d2011499222a0683aed63c881b20ccf70d5775125451bf36b76a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81fc763d0863d2011499222a0683aed63c881b20ccf70d5775125451bf36b76a
SHA3-384 hash: c1062225bc04d5e76f7f841cc4a53baf967abe1c535626e40ba279849b4acdbc8e470b595af284ada7ccb8970608374e
SHA1 hash: 07cc96501710f0d80455fe9b5e34d4b9c1a3d05a
MD5 hash: 5a3452246e02aa71c5d55a89e46cd310
humanhash: missouri-leopard-video-early
File name:payment advice.ro9,pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:622'443 bytes
First seen:2022-01-27 13:18:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:lwZUZJo/ZjsJ6JkY7l60tHDzo9lII+jf89GFzwPat1SKIcOW:GUspf7okfSII+jfBcPatMKsW
TLSH T191D4CEC0ECE6D092CE916BF2D2DFA790852039605BB2EC0F63795B5664B318EE5D50D3
File icon (PE):PE icon
dhash icon 929ada92e8cc3682 (11 x RemcosRAT, 6 x AgentTesla, 3 x Formbook)
Reporter malwarelabnet
Tags:exe FormBook xloader

Intelligence

File Origin
# of uploads :
1
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
payment advice.ro9,pdf.exe
Verdict:
Malicious activity
Analysis date:
2022-01-27 13:29:52 UTC
Tags:
installer trojan formbook stealer
Link:
https://app.any.run/tasks/9889f2fb-0470-4ce2-911a-f4085238fa87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/224322/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Searching for synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe formbook overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61f29bd1c4bcf3287a6132d8/reports/59f9e7e6-d2ab-4d10-a7bb-4f0fbf8b4250/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6e071179-cf3f-4205-bf61-af54666c0b9c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/928982
Behaviour
Behavior Graph:
n/a
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/81fc763d0863d2011499222a0683aed63c881b20ccf70d5775125451bf36b76a/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-01-27 12:20:11 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qh6hmpiimpjacfezeivana5o2y6iqgzazt3q2v3vcjkfdpzww5va._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:tod8 loader rat suricata
Link:
https://tria.ge/reports/220127-qkjjpsdcfq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
fc1b5b2768db34a8c4736edb2327f65a74707b6d4d2b46246a657c103950d722
MD5 hash:
16dda8eabb48dd675af13d82b575f2e7
SHA1 hash:
ce2b022026f490347c8122819f343ef927cf597a
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/914aa0ef-ed12-4b12-b9b5-13aabd73b453/
Parent samples :
81fc763d0863d2011499222a0683aed63c881b20ccf70d5775125451bf36b76a
e8e0f125d909bafae93f469222f2cfbcb30585e03825d8442c8934a92fdd6c89
a70d8c885f8940706226618570ac469b5d45426837c550a15a901a831420daf6
7096f1d2fd14899772fd59c0c7108372d4159ae301b5a790a83c3b42fd366b06
c0d4b591f9c05876d94bcf96f1a91142b1c626093a31e7040a074cf6cfab7e27
5bda5e99c085fb725298ccd23fb9093199c1299e274d0d1bf3ea6d5ad603c518
82ef1696bde1a62d88395ccf385620e0ab4986c41edb7ea197cb8a96fefd1044
0e620198a4a7ea1ae42f2a6a9b0e8c40ce320fc2f52710d86f4158272ebb248f
3f10048526484b831c452aa092009fd9291a043d6c6762e26b88777dcfc35cc4
a5c13a058471a83c916b72920a93cccf42b19de33883004c8048f45ca8a1867f
2b8099c7609f56157c7d2cb7e1da50b2ff85edb62e7599ca995a691b458ceb31
bf9947c6aff5ae8782f98e274a318d36e63c1a95b822ecfe809c6299d26b07b3
74b0f2384ab42a60f4e80f1b3f491989daf0571bc2a753b29dc8ceb30fd3b165
dd6558ccea953f6af92b65eb96b21e9b336f62fe9567f70f92b0973359dff939
SH256 hash:
96774db4929bf8657ff702dc41fe46e8e3c042f5625f26cf65d4d93b3ab0f8e0
MD5 hash:
821fa1d3902f7cbe7d0c173bb86d3dad
SHA1 hash:
c202be4d971eb5eae82bbb9d4eb8dcdaea7fce1d
Link:
https://www.unpac.me/results/914aa0ef-ed12-4b12-b9b5-13aabd73b453/
SH256 hash:
b133ef10c41b4dd470ba411a84c327394cdf7bc4f1277d3e7117aa13da5c05bc
MD5 hash:
f6303ff47a3f9ae77f90a43ce73ed4c4
SHA1 hash:
b8761d249917348eb9b4bbc41cac93c61cbf7dfa
Link:
https://www.unpac.me/results/914aa0ef-ed12-4b12-b9b5-13aabd73b453/
SH256 hash:
81fc763d0863d2011499222a0683aed63c881b20ccf70d5775125451bf36b76a
MD5 hash:
5a3452246e02aa71c5d55a89e46cd310
SHA1 hash:
07cc96501710f0d80455fe9b5e34d4b9c1a3d05a
Link:
https://www.unpac.me/results/914aa0ef-ed12-4b12-b9b5-13aabd73b453/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/81fc763d0863d2011499222a0683aed63c881b20ccf70d5775125451bf36b76a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/224322/

Comments