MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c506402fee84059ee450e9befa30f224e63eac74380a664755f5e9d31f88f91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c506402fee84059ee450e9befa30f224e63eac74380a664755f5e9d31f88f91
SHA3-384 hash: b958fcafaccca2920942d8d006b447eeee7ff7f12bcef9774744458bec91e91e4c48fdd6024d00805e0db5b66f2be261
SHA1 hash: e2945e9553987f2a94e16c91e3ab062dc885504b
MD5 hash: 833b178c0bc651a4216591420ac94f57
humanhash: quebec-hotel-alabama-emma
File name:Midnight.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:4'593'147 bytes
First seen:2022-05-22 06:01:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 49152:Tdfss+0DMmRufGCiL5ud1OfWgppNgVZf:TVRZ2fGDI6WupNgVB
Threatray 36 similar samples on MalwareBazaar
TLSH T1BD26333A23362C74DE75CC7EAD5B940923434366551CBFAB4320AE7AFBDD501A2EC192
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0f0e8e1caeac4f0 (2 x Formbook)
Reporter ShinigamiOwl
Tags:exe FormBook


Avatar
ShinigamiOwl
https://inlnk.ru/Qw58ZA

Intelligence

File Origin
# of uploads :
1
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Midnight.exe
Verdict:
Malicious activity
Analysis date:
2022-05-22 06:03:26 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/8338ba20-0688-418b-9763-85e7605ce9f4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/273388/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% directory
Creating a process from a recently created file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Moving a file to the %AppData% subdirectory
Creating a window
Launching a process
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a file
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/19500/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer control.exe overlay packed redline shell32.dll
Link:
https://www.filescan.io/uploads/6289d1dc6eb3ff32631db562/reports/221b73cb-fa56-40b0-9ad4-52e6368db76f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/69999fab-6339-4516-b7b6-2251b2bfd693
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/999264
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Injects a PE file into a foreign processes
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 631759 Sample: Midnight.exe Startdate: 22/05/2022 Architecture: WINDOWS Score: 100 41 Antivirus / Scanner detection for submitted sample 2->41 43 Multi AV Scanner detection for dropped file 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 2 other signatures 2->47 7 Midnight.exe 10 2->7         started        process3 file4 31 C:\Users\user\...\skazkalzt_crypted.exe, PE32 7->31 dropped 33 C:\Users\user\AppData\Roaming\Sihost67.exe, PE32+ 7->33 dropped 35 C:\Users\user\AppData\...\Salvity_crypted.exe, PE32 7->35 dropped 10 Salvity_crypted.exe 1 7->10         started        13 skazkalzt_crypted.exe 1 7->13         started        15 Sihost67.exe 16 2 7->15         started        process5 dnsIp6 53 Multi AV Scanner detection for dropped file 10->53 55 Contains functionality to inject code into remote processes 10->55 57 Writes to foreign memory regions 10->57 19 AppLaunch.exe 15 3 10->19         started        23 conhost.exe 10->23         started        59 Allocates memory in foreign processes 13->59 61 Injects a PE file into a foreign processes 13->61 25 conhost.exe 13->25         started        27 AppLaunch.exe 13->27         started        39 api.telegram.org 149.154.167.220, 443, 49765 TELEGRAMRU United Kingdom 15->39 29 C:\Users\user\AppData\...\csrss.exe (copy), PE32+ 15->29 dropped 63 Creates multiple autostart registry keys 15->63 file7 signatures8 process9 dnsIp10 37 ip-api.com 208.95.112.1, 49768, 80 TUT-ASUS United States 19->37 49 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->49 51 May check the online IP address of the machine 19->51 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8c506402fee84059ee450e9befa30f224e63eac74380a664755f5e9d31f88f91/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-05-22 06:02:17 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
26 of 40 (65.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rrigiax65baft3sfb2n67iypejhgh2whioakmzdvl5pj2mpyr6iq._file
Verdict:
malicious
Similar samples:
26dde4b7d7de752c625f0144190ab3f7a265d9f140d0d81e6751e56ebd5affc6
Formbook
2dcaabc7567be2d913a8f0df7c972cc19d7ac220889f74342aa40cad5ec80f1d
Formbook
b6a3b9630a6ed8f626b7fdc083c73a03c57923c1055314bacaa49031c5fa6ae3
Formbook
d4688e6e5455d4601d2988f805b8e1652def668899185a6c179827f13e72941a
Formbook
e2f010306e3aaf1a3838ea5bf9d6abefecd5243e17f0ddef47139a80705aae88
Formbook
f30afc8c92569be98fafc998b231adebfdbd987f2f7300570e1046dbf3004f2a
Formbook
f3b96271d81cc65da9566bc124731017fdeb35d192a63a3b5e80b9c0e6148a14
Formbook
+ 26 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/220522-grflyscbej/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
951e7666425b5751da1c1945e550423238a4017206f7afda0219aeaf765f23a2
MD5 hash:
d01cc6b797bf0149a53ebc3a01a4aec5
SHA1 hash:
42d19b6e24c2d7edf18ce8286250e5d158ff33f9
Link:
https://www.unpac.me/results/f9938fa7-152b-4c12-b2dd-a61edabb5b88/
SH256 hash:
b58788c80bff299fc6bf5fb8e7d237642ea436110155c29d16d2da67353bf1e3
MD5 hash:
1ecc616748ef4af9c8c3af50369e4bde
SHA1 hash:
223aad55e5710af34de720456a5f9a9242f274fc
Link:
https://www.unpac.me/results/f9938fa7-152b-4c12-b2dd-a61edabb5b88/
SH256 hash:
4db4ca4a9649584f648d15fd68bfffd239a3f3728bea974b09ae02c125d5099c
MD5 hash:
91ccb7466b3b59605709eaa3e412e3f0
SHA1 hash:
8683c90022ee0c42ee4d0f5b29370cd118443018
Link:
https://www.unpac.me/results/f9938fa7-152b-4c12-b2dd-a61edabb5b88/
SH256 hash:
8c506402fee84059ee450e9befa30f224e63eac74380a664755f5e9d31f88f91
MD5 hash:
833b178c0bc651a4216591420ac94f57
SHA1 hash:
e2945e9553987f2a94e16c91e3ab062dc885504b
Link:
https://www.unpac.me/results/f9938fa7-152b-4c12-b2dd-a61edabb5b88/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8c506402fee84059ee450e9befa30f224e63eac74380a664755f5e9d31f88f91

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_EXE_Packed_ConfuserEx_Custom
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Custom; outside of GIT
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_NET_NAME_ConfuserEx
Create hunting rule
Author:Arnim Rupp
Description:Detects ConfuserEx packed file
Reference:https://github.com/yck1509/ConfuserEx

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 8c506402fee84059ee450e9befa30f224e63eac74380a664755f5e9d31f88f91

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/273388/

Comments