MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424
SHA3-384 hash: 099cc670c4422deb30fb97856479ef1107ee8acb8a05c8f7631ed1496a52e9a5b5c85b51628e7ee4536c13e1f3f4da3d
SHA1 hash: 4702d99d8c7331ab5a9ad73c6538030afebfb261
MD5 hash: f7e48a96209c65bbdcae872e1e7ee559
humanhash: princess-five-london-october
File name:f7e48a96209c65bbdcae872e1e7ee559
Download: download sample
Signature Formbook
Create hunting rule
File size:534'124 bytes
First seen:2021-12-03 10:50:58 UTC
Last seen:2021-12-03 13:40:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:3GiK22gr9KTKT39aZvt7P5lxN4arXpnaAiI+3KdtjC6PhKhHKW1SuHEyzruvEVgF:6yKuTt0L/aAgKdk6JIKIqvvFz
Threatray 11'954 similar samples on MalwareBazaar
TLSH T183B40146B3804E17C4A91B748EE7E365ABB5DDD00B03478B3358BF9D5E722C8385627A
File icon (PE):PE icon
dhash icon a0e5f4d0e4fcf810 (1 x AgentTesla, 1 x Formbook)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
BD00752Q0048971BDDHK.xlsx
Verdict:
Malicious activity
Analysis date:
2021-12-03 10:13:30 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader trojan formbook stealer
Link:
https://app.any.run/tasks/81bc585d-8bf0-4249-ac31-79f3c3c6f802

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/211010/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.3502.10812.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
DNS request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/652/overview
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/61a9f6994d8e6f3a5e0cfb42/reports/40057b0b-701c-4093-a2a8-de9647feec61/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b735b44-03bc-4a15-a4d7-5d5eada7ef06
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/900806
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 533281 Sample: 1ubLhq7IG6 Startdate: 03/12/2021 Architecture: WINDOWS Score: 100 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 2 other signatures 2->41 10 1ubLhq7IG6.exe 17 2->10         started        process3 file4 31 C:\Users\user\AppData\Local\...\vphbzhrj.dll, PE32 10->31 dropped 51 Tries to detect virtualization through RDTSC time measurements 10->51 53 Injects a PE file into a foreign processes 10->53 14 1ubLhq7IG6.exe 10->14         started        signatures5 process6 signatures7 55 Modifies the context of a thread in another process (thread injection) 14->55 57 Maps a DLL or memory area into another process 14->57 59 Sample uses process hollowing technique 14->59 61 Queues an APC in another process (thread injection) 14->61 17 explorer.exe 14->17 injected process8 process9 19 wscript.exe 17->19         started        signatures10 43 Self deletion via cmd delete 19->43 45 Modifies the context of a thread in another process (thread injection) 19->45 47 Maps a DLL or memory area into another process 19->47 49 Tries to detect virtualization through RDTSC time measurements 19->49 22 explorer.exe 1 146 19->22         started        25 cmd.exe 1 19->25         started        27 explorer.exe 1 127 19->27         started        process11 dnsIp12 33 192.168.2.1 unknown unknown 22->33 29 conhost.exe 25->29         started        process13
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2021-12-03 10:51:14 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0c6d57557120decedc9a102794ea95bcaf64529eb1f18058e4df62c34b724988
Formbook
26b24cfe3b0bb84b26fc83ce689b74728ac61f32391772dcc76eab04cc7042b5
Formbook
6cd342f13d56b8bc1d8b1346e3289f7feab428a0a75cfcea4bb31a8c452adf01
Formbook
7f15af6ad30b84b5047a47d92a2319b1043dc00576d80a5cae1e8a23fcb97854
Formbook
936a3e9dfd299c365c2de9e998f6858f4329378fcbeea90b940b98d2eaa1d152
Formbook
c6043c3c87526712c251385dacc61e443647d1dcca1e86ce411e69cb711c4640
Formbook
ceae18ab6ce271c2a6530479958c0ce5c5330988de8d93eefb7b4700ba22f22e
Formbook
e22a659b73048b31aba79fce8de22ddd5a287494b763fec8d5779869dfebbf31
Formbook
ecc6439ff97e4b77f3af320e4c224f712478610fd28a1b6e6a03573c4b90f405
Formbook
+ 11'944 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:og2w rat spyware stealer trojan
Link:
https://tria.ge/reports/211203-mxtnnagbbn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.celikkaya.xyz/og2w/
Unpacked files
SH256 hash:
85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424
MD5 hash:
f7e48a96209c65bbdcae872e1e7ee559
SHA1 hash:
4702d99d8c7331ab5a9ad73c6538030afebfb261
Link:
https://www.unpac.me/results/33987e58-2151-481b-b572-5eebba1fc206/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/85197438716c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1847970/
Cape
Cape
https://www.capesandbox.com/analysis/211010/

Comments


Avatar
zbet commented on 2021-12-03 10:51:00 UTC

url : hxxp://103.171.1.140/hhttsm_h1/.vbc.exe