MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c96178775d7f8dd8b06a4e59aad0367f36abc11680081acfcc2b446fb0ee28b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c96178775d7f8dd8b06a4e59aad0367f36abc11680081acfcc2b446fb0ee28b1
SHA3-384 hash: aff85bdb6f932d35e41f1d23734db3ce7ba41055a1539c41f2fcfc7a07b839b3837cabebbe4a1b67beefbd3bc38d0248
SHA1 hash: 1fc8ead283ee92f4f1c7b3638d6cb91a9a2a6a8e
MD5 hash: dcc82f6d02352ba09401b5e5903fc2c9
humanhash: spaghetti-zebra-blossom-asparagus
File name:PO.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:266'488 bytes
First seen:2021-10-11 13:11:02 UTC
Last seen:2021-10-12 10:59:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:F8LxBsYtBh/OQ8RGTxhLEc3tzhe3ULIGwpGxfi4i0RRAgmKNxM5I:/gFSGTDbDLIGwcx5vEKNKK
Threatray 10'252 similar samples on MalwareBazaar
TLSH T1A544122587C1D4F3CCA30FF105A6ABFBDA7BD50A639E61434BC54E721C7268ACE0A941
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO.exe
Verdict:
Malicious activity
Analysis date:
2021-10-11 18:07:21 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/150d315a-4be1-41c6-8145-fa4803969207

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196611/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16168.23905.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/616437ec1c2d58ba7401cc8e/reports/a9d644e0-da23-48ba-be2e-1f22655965a4/overview
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a3ffa1b7-9e57-46d1-83ae-8ce14c94dee3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/867933
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 500357 Sample: PO.exe Startdate: 11/10/2021 Architecture: WINDOWS Score: 100 31 www.toddtechnical.com 2->31 33 www.blacktgpc.com 2->33 35 2 other IPs or domains 2->35 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for dropped file 2->47 49 6 other signatures 2->49 11 PO.exe 17 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\lzcjm.dll, PE32 11->29 dropped 61 Tries to detect virtualization through RDTSC time measurements 11->61 63 Injects a PE file into a foreign processes 11->63 15 PO.exe 11->15         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 15->65 67 Maps a DLL or memory area into another process 15->67 69 Sample uses process hollowing technique 15->69 71 Queues an APC in another process (thread injection) 15->71 18 explorer.exe 15->18 injected process9 dnsIp10 37 www.brokerdeck.com 18->37 39 toddtechnical.com 34.102.136.180, 49845, 49850, 80 GOOGLEUS United States 18->39 41 brokerdeck.com 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 wlanext.exe 18->22         started        signatures11 process12 signatures13 53 Self deletion via cmd delete 22->53 55 Modifies the context of a thread in another process (thread injection) 22->55 57 Maps a DLL or memory area into another process 22->57 59 Tries to detect virtualization through RDTSC time measurements 22->59 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c96178775d7f8dd8b06a4e59aad0367f36abc11680081acfcc2b446fb0ee28b1/
Threat name:
Win32.Trojan.RemcosRAT
Create hunting rule
Status:
Malicious
First seen:
2021-10-11 12:46:56 UTC
AV detection:
16 of 27 (59.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfqxq525p6g5rmdkjzm2vubwp43kxqiwqaebvt6mfncg7mhofcyq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
4517acad2a12d3e01c67148a0666cec3a631e0bd657b1dbb40efa30f951f9205
Formbook
6d725aa4c3dd38bc7f924af4891b82a9c993e2db67765c72be42778a9c1b561a
Formbook
807ddfd4b164d8e8bb8e0fdc0976db33ae55b021aa7917848a35963c6a4846aa
Formbook
90661f85c7864f95181eceebf32eafd0b4b166aebdfdf5529edfc3a3dd6c0715
Formbook
c12bd972fbf3301e40fa75c3e295a8bd0233bf1f5fa100e79ab7f6755f7b6788
Formbook
c6f3b9901ead534a75aec6bd7f28f50535af887db5857e43848a0268a2e7b9d4
Formbook
cb1140dd7751382a2d56c59755a2ff38b239805148af2d108cf4f1399ca0f753
Formbook
eb39b7952714c4a7c7fbfc68a077ef0a2dd31c24da35078da08bcfc0b1e2ff32
Formbook
ff64ff314c7947e5faae8181ac818b124a6d17d0fc3a66e8777a78a613d6093c
Formbook
+ 10'242 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:w6ya rat spyware stealer trojan
Link:
https://tria.ge/reports/211011-qext5shcb8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.truth-capturemachine.com/w6ya/
Unpacked files
SH256 hash:
c96178775d7f8dd8b06a4e59aad0367f36abc11680081acfcc2b446fb0ee28b1
MD5 hash:
dcc82f6d02352ba09401b5e5903fc2c9
SHA1 hash:
1fc8ead283ee92f4f1c7b3638d6cb91a9a2a6a8e
Link:
https://www.unpac.me/results/283edea5-5c9d-4841-be67-cee89cbc57b3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/c96178775d7f8dd8b06a4e59aad0367f36abc11680081acfcc2b446fb0ee28b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe c96178775d7f8dd8b06a4e59aad0367f36abc11680081acfcc2b446fb0ee28b1

(this sample)

  
Dropped by
formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/196611/

Comments