MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8586e05ff7d2269e9495e76725cc561d433cb771d6af6581ae5fdcf7b8b571d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8586e05ff7d2269e9495e76725cc561d433cb771d6af6581ae5fdcf7b8b571d9
SHA3-384 hash: b8f1bf994a897c5ee5f67808d28256ebcdcb50ff65e89869e0ca451a3b314dd9c0a351547404345381e960a5b2d35d88
SHA1 hash: b22dc4d0252de5b9826fee528aeaa4323decd59e
MD5 hash: 99e98ed938876ac1fe42515bfeb14796
humanhash: carolina-cat-ceiling-magazine
File name:INQUIRY 215082A.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:547'328 bytes
First seen:2022-06-20 12:22:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:pmrbmLwu1Rn+ik2LUtsGuWHxXQWMnq4UhIOYAtZlVgn6PSh5C9wMHMpNVhMP:lwYR/kvRuWHWU2O
Threatray 15'701 similar samples on MalwareBazaar
TLSH T115C48D5CB22C34DEC85BC2769AB45C64AA50746FB72B910790A30D9E9D1CB83DF168F3
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/281570/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.25616.9986.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit packed
Link:
https://www.filescan.io/uploads/62b066acd37f6643508e96f3/reports/de95e174-8d6e-42cf-ab86-b55b2665f857/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d9e6e5df-ec76-42e4-8faf-0b1e8f549668
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1016276
Signature
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 648773 Sample: INQUIRY 215082A.exe Startdate: 20/06/2022 Architecture: WINDOWS Score: 100 41 www.gelasbeauty.com 2->41 43 www.curvecontent.com 2->43 45 2 other IPs or domains 2->45 49 Snort IDS alert for network traffic 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Multi AV Scanner detection for dropped file 2->53 55 9 other signatures 2->55 11 INQUIRY 215082A.exe 6 2->11         started        signatures3 process4 file5 35 C:\Users\user\AppData\...\OLWskJAIzKB.exe, PE32 11->35 dropped 37 C:\Users\user\AppData\Local\...\tmp5DB6.tmp, XML 11->37 dropped 39 C:\Users\user\...\INQUIRY 215082A.exe.log, ASCII 11->39 dropped 65 Injects a PE file into a foreign processes 11->65 15 INQUIRY 215082A.exe 11->15         started        18 schtasks.exe 1 11->18         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 15->67 69 Maps a DLL or memory area into another process 15->69 71 Sample uses process hollowing technique 15->71 73 Queues an APC in another process (thread injection) 15->73 20 explorer.exe 15->20 injected 24 conhost.exe 18->24         started        process9 dnsIp10 47 www.ihavenootropics.com 104.197.214.211, 49842, 80 GOOGLEUS United States 20->47 57 System process connects to network (likely due to code injection or exploit) 20->57 26 cmstp.exe 20->26         started        29 autofmt.exe 20->29         started        signatures11 process12 signatures13 59 Modifies the context of a thread in another process (thread injection) 26->59 61 Maps a DLL or memory area into another process 26->61 63 Tries to detect virtualization through RDTSC time measurements 26->63 31 cmd.exe 1 26->31         started        process14 process15 33 conhost.exe 31->33         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8586e05ff7d2269e9495e76725cc561d433cb771d6af6581ae5fdcf7b8b571d9/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-06-20 08:54:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qwdoax7x2itj5fev45tsltcwdvbtzn3r22xwlanol7oppofvohmq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
774e7baca6802b4d8cf3df0fd6162e1bac6dbfb5a4e50f09bc2d7c9e166b285e
Formbook
8edf8a8b1972c8dd05a960b7a79a7a87c8977b69b700ab9db28bab9207b8b267
Formbook
96d4d635ed435bb8e712a53119a2e3898996b0030832c44beea418d13b7c5370
Formbook
9f604ab9c007da7543c828be85e5508af9541fb039bb9e90283f84b0d6aebdc4
Formbook
b3d7318934eff89f2847b40ff8a0cabc47510bf9fffe21b3c64e59a9ebcc8faa
Formbook
d558d34c10507e01d64d16d440491936bc11cf78032a5e4e1bd154602fd9930c
Formbook
e3d0139657ed78eb6568677c68dbc5a9ce5ad1aa9b86c4bac11a71e5f83addeb
Formbook
e5c9de8a6cc5281bebf892262a830339f2b95efdea84270531d890e2845488fd
Formbook
fab7efa769554cd5b6116b3f662c995aab4d54727f294cc842d4b07c921358d6
Formbook
+ 15'691 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader campaign:nmd2 loader persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220620-pkf8xadagl/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Reads user/profile data of web browsers
Xloader Payload
Formbook
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
8f8d821f9b816b475e1c9f34db67d3a4e7c5e6d0a4dfc462ef67248ad0a5afea
MD5 hash:
af41a321878299875b7d3763ebe91b20
SHA1 hash:
34697adff8512e91fdcaf9f22abdf424fbc5f4b9
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/ca1b1da7-f93e-46d0-ab05-d394361487d2/
Parent samples :
9f604ab9c007da7543c828be85e5508af9541fb039bb9e90283f84b0d6aebdc4
717ab44671da707ee8ad9e5c6e4ade18d6f47841e65a6bd0cebd56c8c1533fcf
0b8058097313b63fec637d226daa0af6abb9f68bb1d0ccb9edb39876453617be
8586e05ff7d2269e9495e76725cc561d433cb771d6af6581ae5fdcf7b8b571d9
085917245898b3d25910807103748a579b389697e79bdceb82b043f66b86a130
f361a889ba650230da217b06b0c41ced6d025c461f29e854583548461dc84668
a28592058ed33d1a46f187fb5fcccbd89b9167ed84c85755aaa8d2d3ceca9003
313566736f3e85c4303541ddf83b100fd80fefe20702cc7c3e10789942127a9e
1722230b243c441e5498ccd145a7a4f8fa00b97d2a22cb20007efb227cce45a9
6f6be5365b28b8c8bd13b442ea0c7f18bbd6cc92d1a6cea7cece4702bcc8cac9
32b04a3fc9feb6bd1b63e6ec096f2cfa0a78f07f86cb08c64f4a24ec5325c0b1
04326067e70a15d7b5139282361d1cd355b2a6c057ca7ac0e901f0a88b139aa7
970e64f4f7b5a8dd1e1f5df8470f372d27585cff9f75a0d3a596427d261bf809
262d23daa434a3eaf7afceeb9b9340f20c040eac7acb6732749c49f433e2e17f
4f4e5e5550b40c160b4dfa9f399b558d2d96ffdf49cc0c81a86a6b3942f1fd94
901b8ec8346c9ec07fb34f17b2eb18f45d6197b0cbb1d7bad6b1cf23ff0cbab1
4863509ff407e4a6389305b5555bc804aa5df9b67290feeb1e36bf68f40696e1
535fb5862370192d9fa74321ef99aa8fe36aaf56689f48411fc7c14b9c984533
f085387dd3ad9b5e949cdb80752a76f1fab4fe66c7eee38a353d0f80b80df7b7
3064b62e720763ef00cfa548424cf74aef8034f8ddc420084519b27b4e1f271e
a5c83c27bf821b97478d7a7cf53e3de83e15fb3a87ff7bdb793afc6ee8d0f64d
7833781bd55b3c69a30841ca9d10a7d8d0bc15b9fbf5cc4d81eee5e2f9591000
1b382c7ca0e34e9e294ea85dfdb722ccfe0b828ecbf5c665a605af31d7277e6f
3fa0d321b17bc7af7e98f723135bf7c3151107f4572f1a41c68f933c488c77b3
SH256 hash:
79823e47436e129def4fba8ee225347a05b7bb27477fb1cc8be6dc9e9ce75696
MD5 hash:
39f524c1ab0eb76dfd79b2852e5e8c39
SHA1 hash:
428018e1701006744e34480b0029982a76d8a57d
Link:
https://www.unpac.me/results/ca1b1da7-f93e-46d0-ab05-d394361487d2/
SH256 hash:
5853cbd16871672dcf6cb6a85de8c9a80bd6a7acfdfedffc9e40efcf6d9dae63
MD5 hash:
0aef0e39da9a37134528845b2326de76
SHA1 hash:
22f89119858f4f57c244d3e0f63e17bd10775c3b
Link:
https://www.unpac.me/results/ca1b1da7-f93e-46d0-ab05-d394361487d2/
SH256 hash:
8586e05ff7d2269e9495e76725cc561d433cb771d6af6581ae5fdcf7b8b571d9
MD5 hash:
99e98ed938876ac1fe42515bfeb14796
SHA1 hash:
b22dc4d0252de5b9826fee528aeaa4323decd59e
Link:
https://www.unpac.me/results/ca1b1da7-f93e-46d0-ab05-d394361487d2/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8586e05ff7d2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8586e05ff7d2269e9495e76725cc561d433cb771d6af6581ae5fdcf7b8b571d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 8586e05ff7d2269e9495e76725cc561d433cb771d6af6581ae5fdcf7b8b571d9

(this sample)

  
Dropped by
formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/281570/

Comments