MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 caa3012813b9ef4bbcc52758baff5cd93b24e15f150523245f8d0a44d5f0914e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: caa3012813b9ef4bbcc52758baff5cd93b24e15f150523245f8d0a44d5f0914e
SHA3-384 hash: ea478e56cad7e38fd4938c867712724318e29aa05df366df1e9af84a46969ff59a6d6d4d340a94cc8bd9c23b254790a0
SHA1 hash: 1d751f3368d8dd33ed3031493e2e6526ae5edf78
MD5 hash: d2f0c205efe01c7dd274d866a69674bf
humanhash: foxtrot-single-queen-iowa
File name:Siparis eklendi.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:967'168 bytes
First seen:2022-05-17 15:38:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4589c846bd72e0ca7ac58c6162ea1f0e (2 x Formbook, 1 x NetWire)
ssdeep 12288:EbJtFabyJi8hChXdhd8HphoUdOJBvxUc8MVJvVN8RdsZU8nY+d7WQsjLf8o6dk:g7KhXdhd+dOK2V97tZUsd73h5u
Threatray 12'707 similar samples on MalwareBazaar
TLSH T15C258E3172E09833D1371A389E1B57A4A936BE50BF64A6B72BF13D4D6F396403835287
TrID 65.6% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
25.9% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
4.2% (.EXE) InstallShield setup (43053/19/16)
1.3% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.2% (.SCR) Windows screen saver (13101/52/3)
File icon (PE):PE icon
dhash icon 161c9bcbd32b565b (5 x Formbook, 2 x NetWire, 1 x ModiLoader)
Reporter abuse_ch
Tags:exe FormBook geo TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Siparis eklendi.exe
Verdict:
Malicious activity
Analysis date:
2022-05-17 20:36:30 UTC
Tags:
installer formbook trojan stealer
Link:
https://app.any.run/tasks/a56749f7-790b-4d98-97ce-d4aa99570a84

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/271701/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader44.60138.14874.11128.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Launching cmd.exe command interpreter
Connecting to a non-recommended domain
Sending an HTTP GET request
Searching for synchronization primitives
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/18391/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm control.exe greyware keylogger replace.exe
Link:
https://www.filescan.io/uploads/6283c1d222b733139c258608/reports/01fb3607-d4d8-47f5-9206-f6df1a30f51a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7808bad2-560a-4fd1-8a3c-da05feadd26c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/996037
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 628534 Sample: Siparis eklendi.exe Startdate: 17/05/2022 Architecture: WINDOWS Score: 100 46 www.huangse5.com 2->46 76 Found malware configuration 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 Antivirus detection for URL or domain 2->80 82 3 other signatures 2->82 11 Siparis eklendi.exe 1 18 2->11         started        16 Gobzjqi.exe 14 2->16         started        signatures3 process4 dnsIp5 54 l-0004.l-dc-msedge.net 13.107.43.13, 443, 49749, 49756 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->54 56 onedrive.live.com 11->56 64 2 other IPs or domains 11->64 42 C:\Users\Public\Librariesbehaviorgraphobzjqi.exe, PE32 11->42 dropped 44 C:\Users\...behaviorgraphobzjqi.exe:Zone.Identifier, ASCII 11->44 dropped 102 Writes to foreign memory regions 11->102 104 Allocates memory in foreign processes 11->104 106 Creates a thread in another existing process (thread injection) 11->106 18 DpiScaling.exe 11->18         started        58 onedrive.live.com 16->58 60 lo94iq.am.files.1drv.com 16->60 62 am-files.fe.1drv.com 16->62 108 Multi AV Scanner detection for dropped file 16->108 110 Injects a PE file into a foreign processes 16->110 21 logagent.exe 16->21         started        file6 signatures7 process8 signatures9 66 Modifies the context of a thread in another process (thread injection) 18->66 68 Maps a DLL or memory area into another process 18->68 70 Sample uses process hollowing technique 18->70 72 Queues an APC in another process (thread injection) 18->72 23 explorer.exe 18->23 injected 74 Tries to detect virtualization through RDTSC time measurements 21->74 process10 process11 25 Gobzjqi.exe 17 23->25         started        29 help.exe 23->29         started        31 control.exe 23->31         started        33 cmd.exe 23->33         started        dnsIp12 48 192.168.2.1 unknown unknown 25->48 50 onedrive.live.com 25->50 52 3 other IPs or domains 25->52 90 Writes to foreign memory regions 25->90 92 Allocates memory in foreign processes 25->92 94 Creates a thread in another existing process (thread injection) 25->94 96 Injects a PE file into a foreign processes 25->96 35 DpiScaling.exe 25->35         started        98 Maps a DLL or memory area into another process 29->98 100 Tries to detect virtualization through RDTSC time measurements 29->100 38 cmd.exe 1 29->38         started        signatures13 process14 signatures15 84 Modifies the context of a thread in another process (thread injection) 35->84 86 Maps a DLL or memory area into another process 35->86 88 Sample uses process hollowing technique 35->88 40 conhost.exe 38->40         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/caa3012813b9ef4bbcc52758baff5cd93b24e15f150523245f8d0a44d5f0914e/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2022-05-17 05:38:37 UTC
File Type:
PE (Exe)
Extracted files:
62
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zkrqckatxhxuxpgfe5mlv7243e5sjyk7cucsgjc7rufejvpqsfha._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1a981386664ccf1aebf2280721e69b96b824ea530bfa3dfd46714f69c86ed9cb
Formbook
2334c08e6eda9469dfa8df0276e4b4cb5e21148b0ee10b8c30da271883cabd35
Formbook
25eeb802abf823d4836eade09779e221790692500abd83cb011f8a4b87d46c95
Formbook
62422d7709489bd4bfe5e5feb34bfd22f0a91269b9b8e8246e407dd597d3f79a
Formbook
ab4f589d0f4ed44507e58153403916908d773badeca5daac840fb7eb6ce7bc54
Formbook
ef45348963373f501b165e141423164651c1663584ac33299e93912529b1553b
Formbook
fa735b49ef95640d075e0fd7cc1c796a5d511a9daf87571b13243364a97daf18
Formbook
+ 12'697 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:modiloader family:xloader campaign:uj3c loader persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220517-s231saggel/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Adds policy Run key to start application
Executes dropped EXE
ModiLoader Second Stage
Xloader Payload
suricata: ET MALWARE FormBook CnC Checkin (GET)
Formbook
ModiLoader, DBatLoader
Xloader
Unpacked files
SH256 hash:
21c0fb2b53a8dc9d38a9cef684adce53f0dd311c3e8861cddda7946408f00b77
MD5 hash:
e91f52a1d9b8f23ae40be2e76017452c
SHA1 hash:
f86fd2cfcc8513e76c7c3ae74ae03d509aa3f453
Link:
https://www.unpac.me/results/e6e9641a-2586-4c5d-a718-87bcc97e2bda/
SH256 hash:
caa3012813b9ef4bbcc52758baff5cd93b24e15f150523245f8d0a44d5f0914e
MD5 hash:
d2f0c205efe01c7dd274d866a69674bf
SHA1 hash:
1d751f3368d8dd33ed3031493e2e6526ae5edf78
Link:
https://www.unpac.me/results/e6e9641a-2586-4c5d-a718-87bcc97e2bda/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/caa3012813b9ef4bbcc52758baff5cd93b24e15f150523245f8d0a44d5f0914e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/271701/

Comments