MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2
SHA3-384 hash: bb7c50b7c1a181bccf02b8323b0daeabe2ebedfede39d8cbde147103a4dc9962715850d68baf654f7c54bbf1ccd0c3cf
SHA1 hash: 711061b453fdad42741ffb94e8dd4bc88c843c3e
MD5 hash: da46f894bfb4c008ec86332694e96c4b
humanhash: alanine-mike-comet-fifteen
File name:PURCHASE_ORDER_QUOTE_08974_PDF.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:343'798 bytes
First seen:2021-09-29 09:17:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:78LxBBz+3meeKNf5Pu5P1Wk7rs8KU/DPP6tCJYdaoXUm:TmeeKrPQDvxK0PPdAaoXUm
Threatray 10'031 similar samples on MalwareBazaar
TLSH T15374BFC67BB05852CE04D63DC32E5F19A42B2F346BE4A24BD65178736BF368D0C17A26
File icon (PE):PE icon
dhash icon 8b13396969336921 (9 x Formbook, 7 x AgentTesla, 4 x SnakeKeylogger)
Reporter GovCERT_CH
Tags:exe FormBook xloader

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE_ORDER_QUOTE_08974_PDF.exe
Verdict:
Malicious activity
Analysis date:
2021-09-29 09:24:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/19604af1-5094-4841-8cef-39408d682cc7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193060/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a window
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4fadb52c-ee58-4449-8598-33eff0902aba
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/860710
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2/
Threat name:
Win32.Trojan.Nsisx
Create hunting rule
Status:
Malicious
First seen:
2021-09-29 07:47:56 UTC
AV detection:
13 of 45 (28.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2b4uphoyl64u7yepntlqz77tly44cquuc5fi5vxzwsap7qolzgza._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2fc82f206abb0d6d6b4d7a916be93b408ab78f848531917b3968b066a5a31023
Formbook
326a1e669385d8e241375e9eca9f915440f1d0d3f803e6d1648f30102cbedaa6
Formbook
45f5e2a682896ac3380522e26a0398b8112bafc42948666c9fecafa3dcab69e3
Formbook
50c6754cbbd313acc6a250182439a1191d8f8318f0794feea75bd647b6205f7a
Formbook
5c8f31380d956958134331ea55e63835fd16ca1f02f4c81672b69db70bc97ab8
Formbook
6acf1bec87a9b06a63ac3be623a527d7c419d17bb8a258b67e2f7cc2c607cc10
Formbook
75772375acbcfb6cb668fc2449671a6a83afe1434184ac7c01fd895825fcf5e6
Formbook
7b4c1bf9a15a419080fe02866aa26f162f79d5e01763c6af5915b07988556223
Formbook
a325ff051ebc1d366533e22fba4a75a4c0b183a28457ed2fea0841f68da06334
Formbook
c10f872ac7d56c5c8d5151eb8d5c3aba275f83bd55700c0dc38776a04b275175
Formbook
+ 10'021 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:m6rs loader rat
Link:
https://tria.ge/reports/210929-k9mprsecg2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.litediv.com/m6rs/
Unpacked files
SH256 hash:
af607b2f4c280f7b465b43a8331dc2d147855e8611a7678d96bd7f6573ba6d7c
MD5 hash:
89e8686c410ab3844d18e618a659c7fd
SHA1 hash:
497f51678e6c1d1c9507d9e1520c1237a87babd0
Link:
https://www.unpac.me/results/47ce9eef-dfa1-4523-b96a-71ee96425f23/
SH256 hash:
d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2
MD5 hash:
da46f894bfb4c008ec86332694e96c4b
SHA1 hash:
711061b453fdad42741ffb94e8dd4bc88c843c3e
Link:
https://www.unpac.me/results/47ce9eef-dfa1-4523-b96a-71ee96425f23/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2

(this sample)

  
Dropped by
xloader
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/193060/

Comments