MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2dbf46751c346aa33fe9d846bf934a7f880f37baee41539917e074b15ada779. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2dbf46751c346aa33fe9d846bf934a7f880f37baee41539917e074b15ada779
SHA3-384 hash: 9a3edc1aacd5a16ee699fbf156755d627face9e49b88c1e9c2bbe102580bc049b646e63f18273bf8dc067f3ad58c8760
SHA1 hash: 5351776308d8c03a2e703aa758b0d4dc739ca643
MD5 hash: c380473d0e661db60d8ea5bf0de605d8
humanhash: white-stream-music-sierra
File name:c2dbf46751c346aa33fe9d846bf934a7f880f37baee41539917e074b15ada779
Download: download sample
Signature Formbook
Create hunting rule
File size:559'504 bytes
First seen:2023-03-14 06:01:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ea4df5d94204fc550be1874e1b77ea7 (241 x GuLoader, 29 x RemcosRAT, 17 x VIPKeylogger)
ssdeep 12288:GzXrK1mPbNroeEEPQ3sKBNFg8L0jME/jL2:B14bNLOXNg8LqvLy
Threatray 608 similar samples on MalwareBazaar
TLSH T122C4F052E4EA45D7E8750A7720B6AD633E465E68D6E4C70A22DC6F1B2032B13C53F12F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 719e2a63f0d1c8cc (1 x Formbook)
Reporter abuse_ch
Tags:exe FormBook signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-01T08:44:40Z
Valid to:2025-04-30T08:44:40Z
Serial number: 362a04fbbae0bf1656434f77d9fbfac54358ead5
Thumbprint Algorithm:SHA256
Thumbprint: 8db4ed4283644bceb4b8b4ffe48ec093b849d21119bd037beb32e6e393bce95d
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
QUOTATION REQUEST-200817-68 APRIL 2023.exe
Verdict:
Malicious activity
Analysis date:
2023-03-13 19:13:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9624ed50-37a0-4241-853d-ec886a7c09ed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/374156/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/73049/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
guloader icedid overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/64100ddbd120e535218ec7d4/reports/d7f4e4cd-82d7-4284-8c3a-0ccfd6aea4bd/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/c2dbf46751c346aa33fe9d846bf934a7f880f37baee41539917e074b15ada779
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/809800c7-4491-4c5b-ae41-0784f0f3b654
Result
Threat name:
FormBook, GuLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1193066
Signature
Antivirus detection for URL or domain
Found potential ransomware demand text
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Opens the same file many times (likely Sandbox evasion)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 12408 Sample: fJXbhkbAh4.exe Startdate: 14/03/2023 Architecture: WINDOWS Score: 100 34 xin3.zhanghonghong.com 2->34 36 www.staatslieden.biz 2->36 38 23 other IPs or domains 2->38 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus detection for URL or domain 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 3 other signatures 2->62 11 fJXbhkbAh4.exe 5 31 2->11         started        signatures3 process4 file5 30 C:\Users\user\AppData\...\PsdrService.dll, PE32+ 11->30 dropped 32 C:\Users\user\AppData\Local\...\System.dll, PE32 11->32 dropped 74 Tries to detect Any.run 11->74 76 Opens the same file many times (likely Sandbox evasion) 11->76 78 Hides threads from debuggers 11->78 15 fJXbhkbAh4.exe 6 11->15         started        signatures6 process7 dnsIp8 46 aninditamywife42.me 172.67.196.8, 443, 49851 CLOUDFLARENETUS United States 15->46 48 Modifies the context of a thread in another process (thread injection) 15->48 50 Tries to detect Any.run 15->50 52 Maps a DLL or memory area into another process 15->52 54 3 other signatures 15->54 19 explorer.exe 3 1 15->19 injected signatures9 process10 dnsIp11 40 mnsmanagmentsolutions.com 162.241.148.192, 49860, 49861, 49862 UNIFIEDLAYER-AS-1US United States 19->40 42 xin3.zhanghonghong.com 122.10.111.133, 49902, 49903, 49904 ULAN-NETWORK-LIMITEDULanNetworkLimitedHK Hong Kong 19->42 44 12 other IPs or domains 19->44 64 System process connects to network (likely due to code injection or exploit) 19->64 23 rundll32.exe 13 19->23         started        signatures12 process13 signatures14 66 Tries to steal Mail credentials (via file / registry access) 23->66 68 Tries to harvest and steal browser information (history, passwords, etc) 23->68 70 Writes to foreign memory regions 23->70 72 3 other signatures 23->72 26 firefox.exe 23->26         started        process15 process16 28 WerFault.exe 4 26->28         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2dbf46751c346aa33fe9d846bf934a7f880f37baee41539917e074b15ada779/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-13 08:15:23 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yln7iz2ryndkum76twcgx6juu74ib433v3sbkomrpyduwfnnu54q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7
Formbook
11b7ed15ae6b1bb53ad3eeff567acb939f794bfdf067b6c3c07c19a15a02fb8f
Formbook
3276e7ff57ccbea104651066c1d45301d52fbfce23d0d48f5238d82a51abd852
Formbook
478e966f1f7aa4d1479c58f0736b4355cd04d2b10c088700e89eb016da7136c5
Formbook
9963c30bed4a82426aa769e6239f538dc038be8bd59b1d43534456b54b29880c
Formbook
9a9d7a41c404b9044a82727996d53222d996f03d71e4839245dbeeaf4c685f77
Formbook
a96ec414b99747cf8859a77e2d05ea24053db3fa343474a007180dfefda658ca
Formbook
af83e815aabba8ca4829ea710a756a3e948fb14e3b6169838e7bba90f1034226
Formbook
c7c1ed4c673f296b1888abfa7f842b18150148771a1ba1196c01194bcc6d5b8e
Formbook
d6ed44f8974685e43802fae6ce9a8aed3e2bdcf8c8bb71b9d5922025f07647e6
Formbook
+ 598 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230314-grflysfh6t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Loads dropped DLL
Unpacked files
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/ac4cd119-88b6-439e-b2aa-3282358b1e20/
SH256 hash:
c2dbf46751c346aa33fe9d846bf934a7f880f37baee41539917e074b15ada779
MD5 hash:
c380473d0e661db60d8ea5bf0de605d8
SHA1 hash:
5351776308d8c03a2e703aa758b0d4dc739ca643
Link:
https://www.unpac.me/results/ac4cd119-88b6-439e-b2aa-3282358b1e20/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c2dbf46751c346aa33fe9d846bf934a7f880f37baee41539917e074b15ada779

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/374156/

Comments