MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1fe85520c015f8f7344de2923392bfbf216bfa02f9db21c8aa4bb20e7e9f192. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1fe85520c015f8f7344de2923392bfbf216bfa02f9db21c8aa4bb20e7e9f192
SHA3-384 hash: aa57eb3e3eba5fdef5a80ffc9e8c8301f15814e488b0ab42b3dcaf5f5f5fefb24ad2d7cb3b0663afcbf38795a396f989
SHA1 hash: ef6ab4aebe8a8c803bc4a4f2f0fb91695133a3a2
MD5 hash: 168a695dbcc82610ddf4c8be25216c05
humanhash: finch-artist-uniform-table
File name:Potvrda ponude.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:609'792 bytes
First seen:2022-05-11 07:52:58 UTC
Last seen:2022-05-12 05:51:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:1aiyHIGAe7ZO87TqUQCdYVfXHmyXEQ4Zmd1f9o:1aiyHF7FiUQCdivmyXEUd99o
TLSH T17DD47E9B5F846A21C1BE6A74966C71B0C3F100DF67BD835F0842B1E46B36799BAC06D3
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter GovCERT_CH
Tags:exe FormBook xloader

Intelligence

File Origin
# of uploads :
4
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/269625/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1329.22982.23212.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Launching a process
Creating a file
Сreating synchronization primitives
Sending a custom TCP request
Creating a file in the %temp% directory
Moving of the original file
Unauthorized injection to a recently created process
Enabling autorun
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cerbu obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/627b6b9fbe0219041a920f40/reports/c7d8e250-1828-4c35-a0e5-1a83484bad7e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5fe5c377-0243-452c-a19d-75a539fad729
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/991674
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Creates an undocumented autostart registry key
Drops PE files to the startup folder
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses cmd line tools excessively to alter registry or file data
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 624170 Sample: Potvrda ponude.exe Startdate: 11/05/2022 Architecture: WINDOWS Score: 100 65 www.gulfund.com 2->65 67 www.bestpleasure4u.com 2->67 107 Snort IDS alert for network traffic 2->107 109 Malicious sample detected (through community Yara rule) 2->109 111 Antivirus detection for URL or domain 2->111 113 7 other signatures 2->113 11 Potvrda ponude.exe 4 2->11         started        signatures3 process4 file5 61 C:\Users\user\...\Potvrda ponude.exe.log, ASCII 11->61 dropped 123 Moves itself to temp directory 11->123 125 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->125 15 java.exe 5 11->15         started        19 cmd.exe 1 11->19         started        signatures6 process7 file8 63 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 15->63 dropped 79 Exploit detected, runtime environment starts unknown processes 15->79 81 Exploit detected, runtime environment dropped PE file 15->81 83 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->83 21 cmd.exe 3 15->21         started        25 cmd.exe 1 15->25         started        85 Uses ping.exe to sleep 19->85 87 Uses cmd line tools excessively to alter registry or file data 19->87 89 Drops PE files to the startup folder 19->89 91 Uses ping.exe to check the status of other devices and networks 19->91 27 reg.exe 1 1 19->27         started        29 PING.EXE 1 19->29         started        32 conhost.exe 19->32         started        signatures9 process10 dnsIp11 57 C:\Users\user\AppData\Roaming\...\java.exe, PE32 21->57 dropped 59 C:\Users\user\...\java.exe:Zone.Identifier, ASCII 21->59 dropped 115 Uses ping.exe to sleep 21->115 34 java.exe 2 21->34         started        37 conhost.exe 21->37         started        39 PING.EXE 1 21->39         started        41 PING.EXE 1 21->41         started        117 Uses cmd line tools excessively to alter registry or file data 25->117 43 PING.EXE 1 25->43         started        46 conhost.exe 25->46         started        48 reg.exe 1 25->48         started        119 Creates an undocumented autostart registry key 27->119 77 127.0.0.1 unknown unknown 29->77 file12 signatures13 process14 dnsIp15 93 Writes to foreign memory regions 34->93 95 Hides that the sample has been downloaded from the Internet (zone.identifier) 34->95 97 Injects a PE file into a foreign processes 34->97 50 AddInProcess32.exe 34->50         started        75 192.168.2.1 unknown unknown 43->75 signatures16 process17 signatures18 99 Modifies the context of a thread in another process (thread injection) 50->99 101 Maps a DLL or memory area into another process 50->101 103 Tries to detect virtualization through RDTSC time measurements 50->103 105 Queues an APC in another process (thread injection) 50->105 53 explorer.exe 50->53 injected process19 dnsIp20 69 www.thecuratedpour.com 74.220.199.6, 49862, 80 UNIFIEDLAYER-AS-1US United States 53->69 71 oecmgroup.com 136.243.24.121, 49863, 80 HETZNER-ASDE Germany 53->71 73 15 other IPs or domains 53->73 121 System process connects to network (likely due to code injection or exploit) 53->121 signatures21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1fe85520c015f8f7344de2923392bfbf216bfa02f9db21c8aa4bb20e7e9f192/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-10 10:23:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
29
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wh7ikuqmafpy642e3yusgojl7pzbnp5af6o3ehekus5sbz7j6gja._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/220511-jqy31sahbn/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
b1a4f59d5b1ddef29779839d7d02297fd1d2869514f72b028db5e5953bd925f5
MD5 hash:
dbf292a6fd340f123284f85164389376
SHA1 hash:
8e5afcd8fa842208e72c224f97f549860cca499d
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/af1a927d-d342-49b7-b2e1-72dbc5efec56/
Parent samples :
b1fe85520c015f8f7344de2923392bfbf216bfa02f9db21c8aa4bb20e7e9f192
51d589a01ef70d7961a53244a56df4427176375e4001481ecae0c88848fc0fed
26255a564473b658bd77619f08223a2a22c42eee8ec43c41b0fbe2335f20ef27
db130f1177379a6c6fc9a87eba59870115f8888d6737f76aba9ea77346d0006c
aa4dc5baf652fff47985d21f8936ff56200d66ff037b12288dd907fa7b1a78ec
SH256 hash:
c611a6ceb263401ed18ff93961bd6d0cdf8757e48d8e76b13943e85b9d3b5a0b
MD5 hash:
f9b293305bd04eee511c0ffd0e7f29d7
SHA1 hash:
fd981a9537a903422311f582defc1c8fd97248af
Link:
https://www.unpac.me/results/af1a927d-d342-49b7-b2e1-72dbc5efec56/
SH256 hash:
7d170109f352f251d7ac012882e005b059b0db5ecce7520acf7be2ba8f13792a
MD5 hash:
72403055ee098f50bcc8a238fdbef878
SHA1 hash:
eb5ed9b38f5a23bb00b221acf3f7233aa2e9299d
Link:
https://www.unpac.me/results/af1a927d-d342-49b7-b2e1-72dbc5efec56/
SH256 hash:
de946071f5ce37d7bd121d1d7123a795c6111bb37715139a956110b97b0ba98a
MD5 hash:
ee5770ede963b3444343d074820acf46
SHA1 hash:
8863ca4d0e2f49f93c5325135931a163d652ab73
Link:
https://www.unpac.me/results/af1a927d-d342-49b7-b2e1-72dbc5efec56/
SH256 hash:
b1fe85520c015f8f7344de2923392bfbf216bfa02f9db21c8aa4bb20e7e9f192
MD5 hash:
168a695dbcc82610ddf4c8be25216c05
SHA1 hash:
ef6ab4aebe8a8c803bc4a4f2f0fb91695133a3a2
Link:
https://www.unpac.me/results/af1a927d-d342-49b7-b2e1-72dbc5efec56/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b1fe85520c015f8f7344de2923392bfbf216bfa02f9db21c8aa4bb20e7e9f192

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe b1fe85520c015f8f7344de2923392bfbf216bfa02f9db21c8aa4bb20e7e9f192

(this sample)

  
Dropped by
xloader
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/269625/

Comments