MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 857217b72741e90dac37cfc2069753957841c31b224e6cd755c07833aa14dbe1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 857217b72741e90dac37cfc2069753957841c31b224e6cd755c07833aa14dbe1
SHA3-384 hash: 82f063f302fd35ef661309a58a31bd391cc992ecb5c98761b0af3624be95fa3f23fc8767363b85c3edd16940c2c82df7
SHA1 hash: a2bb2c49e9b2110824bdd57b5487b7376d9e8a00
MD5 hash: ab325877a3a024da9fda1af137806144
humanhash: stream-september-early-harry
File name:bindropondisc11_SC.bat
Download: download sample
Signature Formbook
Create hunting rule
File size:481'350 bytes
First seen:2023-03-24 21:31:57 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 12288:DWcMt4cZQrTLZiT/qwuRb0OIo2BExKQM1O8umfF9g9xFt:KiTL4CrR4NzBExKQj8um99gJt
Threatray 243 similar samples on MalwareBazaar
TLSH T131A42384B64F2CD1847C020D242ECE682F898FFFFCD4BADA16E45D5B1216B65B857928
Reporter Anonymous
Tags:bat FormBook Loader


Avatar
Anonymous
https://twitter.com/malwrhunterteam/status/1639320109130063872

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bindropondisc11_SC.bat
Verdict:
No threats detected
Analysis date:
2023-03-24 21:35:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1138e296-7ddb-4fae-9799-cce605538287

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/377202/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Launching a process
Creating a file
Creating a process from a recently created file
Creating a file in the %temp% directory
Sending a custom TCP request
Enabling the 'hidden' option for recently created files
Creating a process with a hidden window
Changing a file
Using the Windows Management Instrumentation requests
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/641e16d480ca4ca1ff58fe55/reports/d62df6b7-166f-4616-bb95-6af2c36f00dd/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/857217b72741e90dac37cfc2069753957841c31b224e6cd755c07833aa14dbe1
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1201616
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Suspicious powershell command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 834521 Sample: bindropondisc11_SC.bat Startdate: 24/03/2023 Architecture: WINDOWS Score: 64 29 Multi AV Scanner detection for domain / URL 2->29 31 Antivirus detection for URL or domain 2->31 8 cmd.exe 2 2->8         started        process3 file4 27 C:\Users\user\...\bindropondisc11_SC.bat.exe, PE32 8->27 dropped 33 Suspicious powershell command line found 8->33 12 bindropondisc11_SC.bat.exe 17 8->12         started        15 powershell.exe 7 8->15         started        17 conhost.exe 8->17         started        signatures5 process6 signatures7 35 Adds a directory exclusion to Windows Defender 12->35 19 powershell.exe 7 12->19         started        21 powershell.exe 5 12->21         started        process8 process9 23 conhost.exe 19->23         started        25 conhost.exe 21->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/857217b72741e90dac37cfc2069753957841c31b224e6cd755c07833aa14dbe1/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-03-24 21:32:07 UTC
File Type:
Text (PowerShell)
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvzbpnzhihuq3lbxz7banf2tsv4edqy3ejhgzv2vyb4dhkqu3pqq._file
Verdict:
malicious
Similar samples:
5455441cf085fe5e5c605e6870fadd4f47f215d4525e23f5b75eaabec8cf3705
Formbook
579532a04b63aac5992010d56fa6cc982855b194d9782f5cfff3b063192a94d0
Formbook
8a59fe8ca31ce4abde54d02705f65ed0d788e384e0d5c05441971f4d1fef5b34
Formbook
b6c8d4806e4080ddee5a5b5ff6f3f12074fae9bd31464a147c7ac6851755ca4c
Formbook
cb1e7498dcbe72083463d95b8479c4182c1d90adfc1fd4b03b200850247798ee
Formbook
dc6226d88472e78b79c967c3d151400f1b6e69d7618efd430b64d35b2e20df2e
Formbook
+ 233 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230324-1dl2cshe48/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/857217b72741e90dac37cfc2069753957841c31b224e6cd755c07833aa14dbe1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

783d6753583a5d4a01fdd93d242e29f76324625d3b1c701a3fac161aa325bfce

Formbook

Batch (bat) bat 857217b72741e90dac37cfc2069753957841c31b224e6cd755c07833aa14dbe1

(this sample)

  
Dropped by
SHA256 783d6753583a5d4a01fdd93d242e29f76324625d3b1c701a3fac161aa325bfce
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/377202/
  
Dropped by
SHA256 6781a85bf0dd90e3ba1390143b17c08244f410dc165fa61bf7d6dacb4a4c8656
  
Dropped by
MD5 30f6caa4e5acce16a6db8b1cd8aebb30

Comments