MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d4c21abe700e9fe80d7eee11ed3286a65aaa053b57f7531824a41d0597f92e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d4c21abe700e9fe80d7eee11ed3286a65aaa053b57f7531824a41d0597f92e4
SHA3-384 hash: 22c645a0d3c84fc281b150b64bf401e882fcc696d07f1fdde3269b9fc25ae70c8a405f8c0dd53e7aa9114cbc1740f320
SHA1 hash: d52c1ce84199ea0154b841c41339b7be37148808
MD5 hash: 69609c6ef52b390d329cefc80c006911
humanhash: papa-sweet-potato-arkansas
File name:SecuriteInfo.com.Win32.BackdoorX-gen.22955
Download: download sample
Signature Formbook
Create hunting rule
File size:936'448 bytes
First seen:2022-09-09 13:03:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b9e865dbab68672dc86bace50ed643d1 (2 x ModiLoader, 1 x Formbook)
ssdeep 12288:PcZI0RpZLWuz11zDo3A0eMqM1PyYiDuB6ZGK7jq8OMEI3c41RMCoqlkXWt9Nt1/Z:P4PZKkn8feMqMY3+6HyLwrbMr7c
Threatray 15'044 similar samples on MalwareBazaar
TLSH T15915AD13A450C8B1C5225F355C1BBD689D6DFE112F8C798F62B86D89EF3AB45381B382
TrID 33.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
30.5% (.SCR) Windows screen saver (13101/52/3)
10.5% (.EXE) Win32 Executable (generic) (4505/5/1)
6.9% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
4.8% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 33d0d89696d8d033 (14 x ModiLoader, 9 x DBatLoader, 6 x Formbook)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
344
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.BackdoorX-gen.22955
Verdict:
Malicious activity
Analysis date:
2022-09-09 13:04:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6d8744fe-7601-40ce-8be9-42f6b69a127e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/308992/
Detection(s):
SecuriteInfo.com.Win32.BackdoorX-gen.22955.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Creating a process with a hidden window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/37212/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
evasive greyware keylogger overlay
Link:
https://www.filescan.io/uploads/631b3a061b1b551d04c3182e/reports/55caaf2c-be98-43ad-9784-d86a4c69a595/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f6b21dcf-59af-4e13-9430-5d1f0477d908
Result
Threat name:
DBatLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1067790
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected FormBook
Yara detected UAC Bypass using ComputerDefaults
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 700321 Sample: SecuriteInfo.com.Win32.Back... Startdate: 09/09/2022 Architecture: WINDOWS Score: 100 31 www.trendiddas.com 2->31 33 www.empireapothecary.com 2->33 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus detection for URL or domain 2->49 51 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->51 53 5 other signatures 2->53 10 SecuriteInfo.com.Win32.BackdoorX-gen.22955.exe 1 18 2->10         started        signatures3 process4 dnsIp5 41 l-0003.l-dc-msedge.net 13.107.43.12, 443, 49722, 49724 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 10->41 43 ph-files.fe.1drv.com 10->43 45 2 other IPs or domains 10->45 27 C:\Users\Public\Libraries\Fovqptsiv.exe, PE32 10->27 dropped 29 C:\Users\...\Fovqptsiv.exe:Zone.Identifier, ASCII 10->29 dropped 65 Writes to foreign memory regions 10->65 67 Allocates memory in foreign processes 10->67 69 Creates a thread in another existing process (thread injection) 10->69 71 Injects a PE file into a foreign processes 10->71 15 iexpress.exe 10->15         started        file6 signatures7 process8 signatures9 73 Modifies the context of a thread in another process (thread injection) 15->73 75 Maps a DLL or memory area into another process 15->75 77 Tries to detect virtualization through RDTSC time measurements 15->77 79 Queues an APC in another process (thread injection) 15->79 18 explorer.exe 15->18 injected process10 process11 20 Fovqptsiv.exe 15 18->20         started        dnsIp12 35 l-0004.l-dc-msedge.net 13.107.43.13, 443, 49735, 49737 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 20->35 37 ph-files.fe.1drv.com 20->37 39 3 other IPs or domains 20->39 55 Multi AV Scanner detection for dropped file 20->55 57 Writes to foreign memory regions 20->57 59 Allocates memory in foreign processes 20->59 61 2 other signatures 20->61 24 mspaint.exe 20->24         started        signatures13 process14 signatures15 63 Tries to detect virtualization through RDTSC time measurements 24->63
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d4c21abe700e9fe80d7eee11ed3286a65aaa053b57f7531824a41d0597f92e4/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-09-09 07:51:58 UTC
File Type:
PE (Exe)
Extracted files:
46
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvgcdk7hadu75agx53qr5uzinjs2victwv7xkmmcjja5awl7slsa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0c32394238d4d1a1865110e6f226475422a241176c28f909f114204bf9af9a92
Formbook
4a71e4db2ded6a9e2418c5a47506cc2a0b42feb42dc32692e8ef3ee3c959b3a6
Formbook
57023cbc586b92ef899c3299c174c2689ba5b5e6e970976adde29d9977be9ddb
Formbook
663b7bc66499e507ca1f8fad6e42195a54fe242db3cc71bf4762952fe04ce5ee
Formbook
8b6bed9a53981b3909a06544e89849fd738f9aabf912c36e21777677204e251d
Formbook
ceba84ad5d66f56b623ba771fbf63ff8aabb933047f8787a082df73c9d2240bb
Formbook
d141b9e994a78ea1081fd3ea0768e3c7f01d3f570910923a5ace448b98e63e14
Formbook
ef45348963373f501b165e141423164651c1663584ac33299e93912529b1553b
Formbook
+ 15'034 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:xloader campaign:uj3c loader persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/220909-qaxzcacadm/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Reads user/profile data of web browsers
Adds policy Run key to start application
Executes dropped EXE
ModiLoader Second Stage
Xloader payload
ModiLoader, DBatLoader
Xloader
Unpacked files
SH256 hash:
6d940dbdf35e61b1411c1acc3c76239b979495ae8480652308ceb6eab3224154
MD5 hash:
fff0dcbc0c9ce5e4fa762314f1264123
SHA1 hash:
66c69ef1338225335bad1c394aba3ac1c876ecde
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/3fa324ae-539a-4489-8f55-43b696371c13/
Parent samples :
9d4c21abe700e9fe80d7eee11ed3286a65aaa053b57f7531824a41d0597f92e4
fe323cd5a46b973a6e0ade0cab099d0f929351820421393b29c2a63df6cdd527
48bca1c51f164b95e2f73675cfefdf525bde055caf5c3942bfcee88ff950792d
SH256 hash:
9d4c21abe700e9fe80d7eee11ed3286a65aaa053b57f7531824a41d0597f92e4
MD5 hash:
69609c6ef52b390d329cefc80c006911
SHA1 hash:
d52c1ce84199ea0154b841c41339b7be37148808
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/3fa324ae-539a-4489-8f55-43b696371c13/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9d4c21abe700/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d4c21abe700e9fe80d7eee11ed3286a65aaa053b57f7531824a41d0597f92e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_Formbook_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/308992/

Comments