MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf10226e9ddcf64215ca45ede48c6a2d61fbfe2cb3e1cea7f0ebee38e6a3c707. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf10226e9ddcf64215ca45ede48c6a2d61fbfe2cb3e1cea7f0ebee38e6a3c707
SHA3-384 hash: ec181157f307b0b55afd4d304700236d360e5df64c1fb338342d7b3a63443b21581daa76e4d9ee894ae9ccdc9b463d4d
SHA1 hash: f4b9868b0cf8290ea7ec2b4e1e91e36d8294571c
MD5 hash: bb1b176981654681cc6321b31d4ec366
humanhash: black-hamper-kitten-fix
File name:URMĂRIREA DHL.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:516'891 bytes
First seen:2023-07-12 06:20:06 UTC
Last seen:2023-07-12 06:43:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f23f452093b5c1ff091a2f9fb4fa3e9 (276 x GuLoader, 36 x RemcosRAT, 23 x AgentTesla)
ssdeep 12288:sC3+YT7k0PwTrVg0iTnKqvdmVVN62YDJk0cNhKZR:sa+YHL41gh7vdmDN62YDBczy
Threatray 1'492 similar samples on MalwareBazaar
TLSH T193B4021A31D0D006C1712FB1DB6292FAAABDBC44FDB043873A657F1EB47E6417A483A4
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
255
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
URMĂRIREA DHL.exe
Verdict:
Malicious activity
Analysis date:
2023-07-12 06:20:51 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/70a28db9-bd15-4a51-80b4-7853ede3988a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/416314/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.68114047.18562.16556.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Creating a process from a recently created file
Searching for the window
Launching a process
Sending a custom TCP request
Modifying a system file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/bf10226e9ddcf64215ca45ede48c6a2d61fbfe2cb3e1cea7f0ebee38e6a3c707
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/323b1b93-4869-4c96-a839-cfc9fd5890cd
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1271633
Signature
Antivirus detection for URL or domain
Found suspicious powershell code related to unpacking or dynamic code loading
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Suspicious powershell command line found
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Very long command line found
Writes to foreign memory regions
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1271633 Sample: URM#U0102RIREA_DHL.exe Startdate: 12/07/2023 Architecture: WINDOWS Score: 96 33 Multi AV Scanner detection for domain / URL 2->33 35 Antivirus detection for URL or domain 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 2 other signatures 2->39 8 URM#U0102RIREA_DHL.exe 6 32 2->8         started        12 YourPhone.exe 189 20 2->12         started        process3 dnsIp4 27 C:\Users\user\AppData\...\Commiserated.Joh, ASCII 8->27 dropped 47 Suspicious powershell command line found 8->47 15 powershell.exe 12 8->15         started        31 13.107.5.88 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 12->31 file5 signatures6 process7 signatures8 49 Very long command line found 15->49 51 Found suspicious powershell code related to unpacking or dynamic code loading 15->51 18 powershell.exe 13 15->18         started        21 conhost.exe 15->21         started        process9 signatures10 41 Writes to foreign memory regions 18->41 43 Tries to detect Any.run 18->43 23 ielowutil.exe 6 18->23         started        process11 dnsIp12 29 192.185.74.166 UNIFIEDLAYER-AS-1US United States 23->29 45 Tries to detect Any.run 23->45 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf10226e9ddcf64215ca45ede48c6a2d61fbfe2cb3e1cea7f0ebee38e6a3c707/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-07-11 11:32:33 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x4ice3u53t3eefokixw6jddkfvq7x7rmwpq45j7q5pxdrzvdy4dq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
cloudeye
Create hunting rule
Similar samples:
4339763c2998a0b0a63f0a1e0034decd766d3fc8d3cf35e946a7b12c9e34ab3e
FormBook
68ba26474bb29bdbc42cfddd75f212eec1ffa22d5c1affc893addce5330f4e11
FormBook
6e5b648d1e574dfbbd6337c6d11b851b2b12efec1f0ae59b1327e0dce1dfe7e6
FormBook
719b031a6eb4fb932f4ddc541bcd119995ea7273f77c9bbe663273401d157513
FormBook
97bd79e26600f552bfb5764aec1606acb63b830b5fefb807d12fe2088854a3cc
FormBook
b80d975ddd8e28bf201a5dd08cbfa50ef211aa5600f33b4c10e6d72068864f13
FormBook
c1e64e86dd89a5820bbb518ead2176741f91d3bf5c579e154533d44e816c1f76
FormBook
e54d5060f522ac4aae58c95d299bff21e5e6e014c941cd0a9e88485ea29e4ebc
FormBook
ead9b9c37d63a3b18959e6f4926d76364408f76ed882fad8e8b34ec496702bda
FormBook
ec9d091c881ad4da6f5e77f947c2723b1aa374fbf373931871c767dfb9cabb0e
FormBook
+ 1'482 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:guloader campaign:il09 discovery downloader persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/230712-g4b5asdb6z/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Checks QEMU agent file
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook payload
Formbook
Guloader,Cloudeye
Unpacked files
SH256 hash:
bf10226e9ddcf64215ca45ede48c6a2d61fbfe2cb3e1cea7f0ebee38e6a3c707
MD5 hash:
bb1b176981654681cc6321b31d4ec366
SHA1 hash:
f4b9868b0cf8290ea7ec2b4e1e91e36d8294571c
Link:
https://www.unpac.me/results/4492b1b0-66b1-4fa6-8601-797892d14acb/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bf10226e9ddc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe bf10226e9ddcf64215ca45ede48c6a2d61fbfe2cb3e1cea7f0ebee38e6a3c707

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/416314/

Comments