MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0904a36e97e50225bc8ab11f7a9c588ebc758b1dc624d39d94da1f5268b847e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0904a36e97e50225bc8ab11f7a9c588ebc758b1dc624d39d94da1f5268b847e
SHA3-384 hash: d941792904a4c748956f39704866094fc6176f4f0cbe7b906d2575a12eac5bf43f0f70907411d20fe4d933b22f6cf81d
SHA1 hash: 1e1fadb528d4a707d91387c3a7525ed3bd1ceb05
MD5 hash: c8d33f72301ac9ac24009e27ac7e53ef
humanhash: sixteen-edward-avocado-nebraska
File name:c8d33f72301ac9ac24009e27ac7e53ef.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:290'157 bytes
First seen:2022-01-20 08:53:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:owU8Br6MGwDxAO72NoFxBCOQZAz59yNHtLVUZ9rw4V7oI3Z3cNS:IirIwCO7FFxBQ0594W7rwi3ZOS
Threatray 13'087 similar samples on MalwareBazaar
TLSH T1C654224D3AC5E0FBEA4695352822471D97BAE1872220069FD7B40FB96C173F16B023E3
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
request1266514.pdf
Verdict:
Malicious activity
Analysis date:
2022-01-20 06:30:27 UTC
Tags:
encrypted trojan exploit CVE-2017-11882 loader formbook stealer
Link:
https://app.any.run/tasks/978fb0d4-73cf-422d-9468-9c1f9414170d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/221005/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
DNS request
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
expand.exe
Link:
https://www.filescan.io/uploads/61e92330f81da814af920682/reports/904ead51-d6e5-437b-a178-263c5ec6329d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/84110fda-8ba4-471c-aad6-ac7564727fc7
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/924156
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Sigma detected: CMSTP Execution Process Creation
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 556640 Sample: u3qWeamzmU.exe Startdate: 20/01/2022 Architecture: WINDOWS Score: 100 29 www.jobportalsg.com 2->29 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus detection for URL or domain 2->51 53 6 other signatures 2->53 10 u3qWeamzmU.exe 19 2->10         started        signatures3 process4 file5 27 C:\Users\user\AppData\Local\...\oomjko.dll, PE32 10->27 dropped 55 Tries to detect virtualization through RDTSC time measurements 10->55 57 Injects a PE file into a foreign processes 10->57 14 u3qWeamzmU.exe 10->14         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 14->59 61 Maps a DLL or memory area into another process 14->61 63 Sample uses process hollowing technique 14->63 65 Queues an APC in another process (thread injection) 14->65 17 cmstp.exe 14->17         started        20 explorer.exe 14->20 injected process9 dnsIp10 37 Self deletion via cmd delete 17->37 39 Modifies the context of a thread in another process (thread injection) 17->39 41 Maps a DLL or memory area into another process 17->41 43 Tries to detect virtualization through RDTSC time measurements 17->43 23 cmd.exe 1 17->23         started        31 www.sh-cy17.com 168.76.74.26, 49814, 80 ULTRANETSERVICOSEMINTERNETLTDABR South Africa 20->31 33 studio-levanah.com 81.169.145.84, 49793, 80 STRATOSTRATOAGDE Germany 20->33 35 8 other IPs or domains 20->35 45 System process connects to network (likely due to code injection or exploit) 20->45 signatures11 process12 process13 25 conhost.exe 23->25         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c0904a36e97e50225bc8ab11f7a9c588ebc758b1dc624d39d94da1f5268b847e/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-01-20 08:34:25 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
194eecb866b404241cc14abfccf3ece512927dafff1e64248e1b1fb4e4acbd26
Formbook
1b63747868505bd36bda5292992b2ff09c371844379d7a180530e02186524627
Formbook
4f64511b423d79682dfad8f6b516516d32e801f0031f07b7e3c6c19798a64b95
Formbook
57037671020fbbcf7e45114c351297ed8ccf818410c36aa4030434bc41ce86b3
Formbook
64c7583a94ab474b9cd3509e8ca73eb7a19e70ffc2c4fa4582ccd7fd3f10c5ec
Formbook
6846492babd6809fcbf6d1a30ebd47db29061bc23237069ff85a86b406b1abb0
Formbook
73f458d7e38ab748b7b7d3b3e680db9eb08d845c1b1b7c935a6ee453d8f03358
Formbook
75e51d5e7662ad2c7ee23822ebf5246ce2d3257734ef87883f57bbcffe13c5d2
Formbook
889a99efe47a7cd2f2ee5797086d76e5811f9502047d9be1c6cbc1dc815c57fe
Formbook
deac58296321ec67026dc3de7275137fbdf1775e28fbd9e4d3bf528be7bc95ff
Formbook
+ 13'077 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:jdo2 loader rat
Link:
https://tria.ge/reports/220120-ktwmqshbg2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Unpacked files
SH256 hash:
82cc48b1b44bb82d4e9453fb4c2a684f60d96b41c2a9f656d00924355e089b11
MD5 hash:
7d665607943225a5807e5f2a565656ce
SHA1 hash:
e626889023a06d375c0b5f64781ed7ae4dbee7d0
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/d30ef751-08ab-46d6-a118-1ddef1346001/
Parent samples :
38ff81c0547d423ae07f234ec45351dd976300cc5197274b6be8dad0b89ec61e
c0904a36e97e50225bc8ab11f7a9c588ebc758b1dc624d39d94da1f5268b847e
c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e
a58fa4c9cd9960a9b7c8fbab4942b3d1f28035ce37b68b4835afa9e728cbdc0a
SH256 hash:
eda936b8417ac3afcb4d296cfb1eb50280988af75c4560ad4cf4de4f81f69fb2
MD5 hash:
91a0e399889a2f47e3c6e139cda5c80e
SHA1 hash:
9d3aad215a2b9a732eb32bcf10c99110d0790d98
Link:
https://www.unpac.me/results/d30ef751-08ab-46d6-a118-1ddef1346001/
SH256 hash:
c0904a36e97e50225bc8ab11f7a9c588ebc758b1dc624d39d94da1f5268b847e
MD5 hash:
c8d33f72301ac9ac24009e27ac7e53ef
SHA1 hash:
1e1fadb528d4a707d91387c3a7525ed3bd1ceb05
Link:
https://www.unpac.me/results/d30ef751-08ab-46d6-a118-1ddef1346001/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/c0904a36e97e50225bc8ab11f7a9c588ebc758b1dc624d39d94da1f5268b847e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe c0904a36e97e50225bc8ab11f7a9c588ebc758b1dc624d39d94da1f5268b847e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1983091/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/221005/

Comments