MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cab907df419f9a95b889719e1c302c9693f711ea74e2f73e60ce14f3284704a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cab907df419f9a95b889719e1c302c9693f711ea74e2f73e60ce14f3284704a6
SHA3-384 hash: c256bb51c80df335ac7a98cca5d9249bb7c6e7ffe2f74af9f49bd22218b2e0a3ea20105681998a4d46442af379a1e331
SHA1 hash: 28a87403823ad4f0d3a0a50f2a3b4357264cdea8
MD5 hash: c518288f75b3d5ee671193c32f88be3c
humanhash: lion-fix-saturn-mars
File name:c518288f75b3d5ee671193c32f88be3c
Download: download sample
Signature Formbook
Create hunting rule
File size:73'728 bytes
First seen:2021-08-25 12:50:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:OYNBAwAMglUoYAhMAYbcYMXgYUQ4ZQOFXh2M:OYowAMglUoYAhMAYbcY7YUQ4ZQOFx2M
Threatray 382 similar samples on MalwareBazaar
TLSH T1AD73E19875B6A566CAAC89704F41BE3083F21D31E6CDF7A1EDB710B5DE693006520B8F
dhash icon 71e8d2868ecce071 (1 x Formbook)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
343
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Proforma Invoice.xlsx
Verdict:
Malicious activity
Analysis date:
2021-08-25 11:50:41 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader trojan formbook stealer
Link:
https://app.any.run/tasks/d5116f78-3684-4208-affb-9a05fbbe9898

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182319/
Detection(s):
SecuriteInfo.com.ArtemisC518288F75B3.5453.31345.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Connection attempt
Sending an HTTP GET request
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ba316556-cd02-431e-8820-63ddcff3ff6b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/839061
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Drops PE files to the startup folder
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 471496 Sample: RO5SbhWoA2 Startdate: 25/08/2021 Architecture: WINDOWS Score: 100 75 Found malware configuration 2->75 77 Malicious sample detected (through community Yara rule) 2->77 79 Multi AV Scanner detection for submitted file 2->79 81 6 other signatures 2->81 10 RO5SbhWoA2.exe 3 2->10         started        13 RO5SbhWoA2.exe 15 4 2->13         started        process3 dnsIp4 57 C:\Users\user\AppData\...\RO5SbhWoA2.exe.log, ASCII 10->57 dropped 16 RO5SbhWoA2.exe 10->16         started        61 185.215.150.75, 49730, 49733, 49748 UNREAL-SERVERSUS Netherlands 13->61 19 cmd.exe 1 13->19         started        21 cmd.exe 3 13->21         started        file5 process6 file7 63 Modifies the context of a thread in another process (thread injection) 16->63 65 Maps a DLL or memory area into another process 16->65 67 Sample uses process hollowing technique 16->67 69 Queues an APC in another process (thread injection) 16->69 24 explorer.exe 16->24 injected 71 Suspicious powershell command line found 19->71 26 powershell.exe 19 19->26         started        28 wscript.exe 19->28         started        30 conhost.exe 19->30         started        32 timeout.exe 1 19->32         started        53 C:\Users\user\AppData\...\RO5SbhWoA2.exe, PE32 21->53 dropped 55 C:\Users\...\RO5SbhWoA2.exe:Zone.Identifier, ASCII 21->55 dropped 73 Drops PE files to the startup folder 21->73 34 conhost.exe 21->34         started        signatures8 process9 process10 36 WWAHost.exe 24->36         started        39 systray.exe 24->39         started        41 RO5SbhWoA2.exe 2 26->41         started        dnsIp11 83 Modifies the context of a thread in another process (thread injection) 36->83 85 Maps a DLL or memory area into another process 36->85 87 Tries to detect virtualization through RDTSC time measurements 36->87 44 cmd.exe 36->44         started        59 192.168.2.1 unknown unknown 41->59 46 RO5SbhWoA2.exe 41->46         started        49 RO5SbhWoA2.exe 41->49         started        signatures12 process13 signatures14 51 conhost.exe 44->51         started        89 Modifies the context of a thread in another process (thread injection) 46->89 91 Maps a DLL or memory area into another process 46->91 93 Sample uses process hollowing technique 46->93 process15
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cab907df419f9a95b889719e1c302c9693f711ea74e2f73e60ce14f3284704a6/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-08-25 12:51:06 UTC
AV detection:
10 of 27 (37.04%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zk4qpx2bt6njloejogpbymbms2j7oepkotrpoptazykpgkchasta._file
Verdict:
unknown
Similar samples:
0c6dc22b15d24f2fc4f68fad89b8e5cb831fb01ce4d66c02f84cb3def1d24c01
Formbook
19d4050d0e2cfb28e62d91052123b50ead9c4c84501accb05e523c9593960245
Formbook
1ba68a19bea8cc34d1145e30c3edd928a4bbc35798f13c109be206eb7b8ac89a
Formbook
26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7c2886e26e768eb10a81
Formbook
3ab1f343f5fde1980fdb3735cff794d025fc2f9814fbf7cb0bdb64c1030ca621
Formbook
8e3c9001f9377d8c55aabd93e84e71e5b0eaa73bf783e880ef70476b442348b7
Formbook
af39da9af98c382d3a779807cfcf7d127e395661d3718089693cd810f60119aa
Formbook
f4fd51e6e0684d722cfacceb9a3abb8e4c449e96dce19b1f8b47fc8b09abf9df
Formbook
f89a5f2fb9ba4e0e3714a51dff8ca9f56cc54f66368ceadf66e503942c4abac8
Formbook
+ 372 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:mo8t loader rat
Link:
https://tria.ge/reports/210825-5wfh2dv2re/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.yizi.info/mo8t/
Unpacked files
SH256 hash:
cab907df419f9a95b889719e1c302c9693f711ea74e2f73e60ce14f3284704a6
MD5 hash:
c518288f75b3d5ee671193c32f88be3c
SHA1 hash:
28a87403823ad4f0d3a0a50f2a3b4357264cdea8
Link:
https://www.unpac.me/results/fe68374e-dedf-46eb-9e5d-afed2b80a8b7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cab907df419f9a95b889719e1c302c9693f711ea74e2f73e60ce14f3284704a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe cab907df419f9a95b889719e1c302c9693f711ea74e2f73e60ce14f3284704a6

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1563270/
Cape
Cape
https://www.capesandbox.com/analysis/182319/

Comments


Avatar
zbet commented on 2021-08-25 12:50:59 UTC

url : hxxp://185.215.150.75/vb/Raz.exe