MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
SHA3-384 hash: cfec4ca8bd94b239911e59cd62adc5d5b69c2f5f29533c30b1aca4ab02ae1ed3875ffa5d838b9cd56400c90f30a42aec
SHA1 hash: 82a913894418af7834d23bc543eb286230d4edf4
MD5 hash: 98f9ea244308bb5969ea3c302c32efcd
humanhash: asparagus-india-uranus-tango
File name:RFQ_AP65425652_032421 isu-isu,pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:397'431 bytes
First seen:2021-04-08 06:54:58 UTC
Last seen:2021-04-08 08:26:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 18bc6fa81e19f21156316b1ae696ed6b (51 x Formbook, 24 x Loki, 9 x SnakeKeylogger)
ssdeep 6144:Dd9stvLGtELbMUTKZXQOnn7UGV5wD3hbCQ0Ga7BjHVLF7R:bSityjKzn7Uw5wD3hbQBRFN
Threatray 4'575 similar samples on MalwareBazaar
TLSH 5B845D823185DC9AE04329F258AFD57061787D9E8165C60E3743BF2BA5E7343346B78E
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cloudhost-831079.us-midwest-1.nxcli.net
Sending IP: 8.29.153.156
From: CHIPTRONICS (M) SDN. BHD. <info1@chiptronics.com.my>
Subject: RFQ_AP65425652_032421 Segera
Attachment: RFQ_AP65425652_032421 segera,pdf.iso (contains "RFQ_AP65425652_032421 isu-isu,pdf.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ_AP65425652_032421 isu-isu,pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-04-08 07:46:55 UTC
Tags:
installer trojan formbook stealer
Link:
https://app.any.run/tasks/c2c591da-481a-4a5a-a05a-9af75893b65a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133047/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46046109.952.11135.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Sending a custom TCP request
Unauthorized injection to a recently created process
Sending a UDP request
Launching a process
Launching cmd.exe command interpreter
DNS request
Sending an HTTP GET request
Unauthorized injection to a system process
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/670045
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 383968 Sample: RFQ_AP65425652_032421 isu-i... Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 31 www.lideresdeimmunocal.com 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 7 other signatures 2->45 11 RFQ_AP65425652_032421 isu-isu,pdf.exe 18 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\fsfomt.dll, PE32 11->29 dropped 55 Maps a DLL or memory area into another process 11->55 15 RFQ_AP65425652_032421 isu-isu,pdf.exe 11->15         started        signatures6 process7 signatures8 57 Modifies the context of a thread in another process (thread injection) 15->57 59 Maps a DLL or memory area into another process 15->59 61 Sample uses process hollowing technique 15->61 63 Queues an APC in another process (thread injection) 15->63 18 explorer.exe 15->18 injected process9 dnsIp10 33 luegomusic.com 162.241.244.61, 49764, 80 UNIFIEDLAYER-AS-1US United States 18->33 35 www.pierresplayhouse.com 199.59.242.153, 49771, 80 BODIS-NJUS United States 18->35 37 19 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 control.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 02:27:12 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zuus2tg3l74pfxqipie54kqve4rnsehr356opns6msal5gxhp7pq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01476f904e668758ea516e84f359d6d0a4d85dadc179a51788a214ea46ff9dec
Formbook
1925c407d4f24ed0e1e002a57042e4cec58f9e09bde7c441f6f5b9ca5748ea20
Formbook
34066150ffa7efa505b8d2246925cd8a32f83b9609438ae76aa27cef7388054d
Formbook
63b94415ccf2fabff3be3a811ded9a5306d68ac197adc07d7c2be3b313e8a665
Formbook
6657aeabd5ded830361aad9112749d785fc0fbe46121daeb7acb23cd841274ed
Formbook
7ec78d6c2c919a22185cb0000f2e273d66019b8409a3ca47c819d44cedead22e
Formbook
8412907b0441a1695b45e1de5e7b446d28ab00f6da416bdb2575f51eb60e9647
Formbook
bd6055810a703f4f0caec388c7cce89661ee9451179dc3abe6261480bda4105e
Formbook
c36c6fd8b9b9f444675b6c97fa1dfa2c2fa05aba6c0f6f4f164e0cf7d1e5bfc7
Formbook
fd0cf58b93453778c312805f74673284da2548389ee866c37cc91431f0ba9cb1
Formbook
+ 4'565 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210408-rzr1sx19te/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Blocklisted process makes network request
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.luegomusic.com/pe0r/
Unpacked files
SH256 hash:
5eb2ca7ef67e0748b9ed095660f89b0fe7972c30cb06f56d05e75c0899305831
MD5 hash:
ba2ad591ce772a5d280c3f20d6a42998
SHA1 hash:
ca6c574f5f1cb219754ea06459b3039e96a2d6c9
Link:
https://www.unpac.me/results/a3b21826-27ed-4672-a24e-8b8b3bad5ad5/
SH256 hash:
cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
MD5 hash:
98f9ea244308bb5969ea3c302c32efcd
SHA1 hash:
82a913894418af7834d23bc543eb286230d4edf4
Link:
https://www.unpac.me/results/a3b21826-27ed-4672-a24e-8b8b3bad5ad5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 6fda91b131f727b4d80dfb1b69b8c934fec693986723dd59585f8ca016a3dfb1

Formbook

Executable exe cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf

(this sample)

  
Dropped by
MD5 d0e0fad1c1c9538cffb4ac5d488d3251
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/133047/
  
Dropped by
SHA256 6fda91b131f727b4d80dfb1b69b8c934fec693986723dd59585f8ca016a3dfb1

Comments