MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
SHA3-384 hash: 58cedf365e60838e5507ee4bb93b3f380197dcdbce0244ab48605692d06c44e791ec77f545c8871198d704143541d7bd
SHA1 hash: fcd1bcb3d3b932133a5f9749934dc32d6a822ae5
MD5 hash: 86c0573a6920ba2f12101ca3c042358c
humanhash: kansas-west-white-freddie
File name:Documents.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'344'000 bytes
First seen:2023-03-02 12:20:49 UTC
Last seen:2023-03-02 13:37:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:bUbUG3MzSSV93QMOEAlQ/ECDrmI7B2qnsq0neaZibqr9NGtLUV3SxHnCcddAE:xSSDYa/EyB24aQbqr9QOIoe2
Threatray 2'121 similar samples on MalwareBazaar
TLSH T13355B82809FC0AF2C5B1F1FD9FD4E753BD848CE6AA049D9982834B89555385720AFD3E
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter cocaman
Tags:exe FormBook INVOICE

Intelligence

File Origin
# of uploads :
3
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Documents.exe
Verdict:
Malicious activity
Analysis date:
2023-03-02 12:22:43 UTC
Tags:
stealer formbook trojan
Link:
https://app.any.run/tasks/f9817d03-035c-4652-a298-185690b4ac2c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/371156/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Basic.5.Gen.26618.3682.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/640094b02ea6b36966305e96/reports/1eae10c1-0fdd-4c9d-9475-f52c76c96116/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.5
Link:
https://www.hybrid-analysis.com/sample/d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0bf86bff-9816-4d60-88df-9eebebbff8c3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1185698
Signature
Antivirus detection for URL or domain
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netstat to query active network connections and open ports
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 818563 Sample: Documents.exe Startdate: 02/03/2023 Architecture: WINDOWS Score: 100 34 Malicious sample detected (through community Yara rule) 2->34 36 Antivirus detection for URL or domain 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 3 other signatures 2->40 8 Documents.exe 3 2->8         started        process3 file4 22 C:\Users\user\AppData\...\Documents.exe.log, ASCII 8->22 dropped 50 Writes to foreign memory regions 8->50 52 Injects a PE file into a foreign processes 8->52 12 RegSvcs.exe 8->12         started        signatures5 process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 12->54 56 Maps a DLL or memory area into another process 12->56 58 Sample uses process hollowing technique 12->58 60 Queues an APC in another process (thread injection) 12->60 15 explorer.exe 2 6 12->15 injected process8 dnsIp9 24 www.42230.org.wcdnga.com 163.171.128.148, 49740, 49741, 80 QUANTILNETWORKSUS European Union 15->24 26 matrukrupacc.com 216.10.248.111, 49714, 80 PUBLIC-DOMAIN-REGISTRYUS India 15->26 28 10 other IPs or domains 15->28 30 System process connects to network (likely due to code injection or exploit) 15->30 32 Uses netstat to query active network connections and open ports 15->32 19 NETSTAT.EXE 13 15->19         started        signatures10 process11 signatures12 42 Tries to steal Mail credentials (via file / registry access) 19->42 44 Tries to harvest and steal browser information (history, passwords, etc) 19->44 46 Modifies the context of a thread in another process (thread injection) 19->46 48 Maps a DLL or memory area into another process 19->48
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-03-02 12:21:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
23 of 25 (92.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2fqt63fgrtoxwsiotrbldk6ewxdrvlpri2lxxx6d6tjt2ljtcwoq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7
Formbook
0dd1d1a74f49a15f9b7dcfc7890060807198b74b835cb17f60886a0f2c9c1376
Formbook
28ca1fe12d85075d947b1bc3292c14cba784ed1e22287e56819d9a1d86b2f7e4
Formbook
375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c
Formbook
3e924b372c019c41e9995a276ce5c1b1487d14ceb9fbc8d606a09a83df5989b8
Formbook
5a2e7eb559e1d587d537ff0033d00fb27f7e17bf0c2a5db6bb3842b9e2fa9972
Formbook
7fd5172067f790c21d11dc37987f04bbe9e4c04038074b788ac79bcc83c06f1a
Formbook
ae1f2c8fd75695601dbe0f3b3fd00922495add9f623a81c0989c0fd17f10776b
Formbook
d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
Formbook
+ 2'111 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230302-pjbl2acg97/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Unpacked files
SH256 hash:
ef3c7bf77e06f90c5fee8f82de30d15cde347504601a2f4a4da5c808fda3d146
MD5 hash:
d721abd1774d5d25c516645d1613380b
SHA1 hash:
1d6ea57141f658bfbcbfa9f30cff02639897a9bd
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/a264e650-8ee5-4404-8979-6cc91de8c8d7/
Parent samples :
7fd5172067f790c21d11dc37987f04bbe9e4c04038074b788ac79bcc83c06f1a
375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c
d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
e92f7d954c97723d975ffb5d04438494d692c6bd3b552a24d826e13ae6252ef4
aa5548a9ee7fbe66cbff5c8488bd260ee5377818faac895fecf519fc0bdf453b
ac8157f89fe4d01eb6e009147f4e6a3b64ebd924af77f4c4999b7dba22b53e4d
13c4ed220256fb2dfb95631c042d9eadf977bd2dc5e4aa0898ab99bd16d33ef7
07ea5734d5a27eec2e18629559643c25f87676c8f81f9abe12aebf742dead0d1
07843e27993206a92d9e0bfbb249332fcfedad068bec8f7f7f3f318654c7910c
ae2e5e556f6fab620a62ed8dfe072e73ebff0a207177e48cb3b65253055205d4
ac61c80f02e15eb3705836ff8dc9d81543eb0e26059d4aaa9b0895c716deafe4
b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674
179b98e2cb16a094755f853ae892b47948a8b6a83e7ca050d520e113ff180b2f
1bf1d7519eb3538201392d2bc32be1ebf4e2cd720d637bc94a67d0765f6a645a
fe7957318166dd7147d4b7b42360f9369f0657308fa68f929d573d4ac99aed9d
40d4375902fce141fe2e90e675790acb6b8f3d98fb2a53a90aa18cbd629a51ef
SH256 hash:
c5f46eae4c3daf89f723d9a0ed54928319b429e8e6b7e090b6d9887a7f8ef56a
MD5 hash:
efb0011b5da4e019d914f3c0ab18f002
SHA1 hash:
0be02538e44f1a12f5b61d90c94f9bd20c562813
Link:
https://www.unpac.me/results/a264e650-8ee5-4404-8979-6cc91de8c8d7/
SH256 hash:
af58770ff380ca8b00c131363727afa1c18d1603c768f31eb14d45af2a802c6f
MD5 hash:
178063633a11019a4babed2aa8dcf24f
SHA1 hash:
f667c8300e264cef6c7f60feef7183f29bd72459
Link:
https://www.unpac.me/results/a264e650-8ee5-4404-8979-6cc91de8c8d7/
SH256 hash:
1ca385bd3f4ca0493e3efcd83451292b0add472eac326f2a16b1344c01ce9a55
MD5 hash:
941cefb61cfb63d2ba8b6331fc335213
SHA1 hash:
bf1fdb6224a5361d9231e6acd83454dae6a152b3
Link:
https://www.unpac.me/results/a264e650-8ee5-4404-8979-6cc91de8c8d7/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/a264e650-8ee5-4404-8979-6cc91de8c8d7/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
20f770342c96a99ebb9531f432a2f2aa7f898740d655ccfe6c07e0255237bc92
MD5 hash:
bcbbfd902fe0f287a41beefd16678af3
SHA1 hash:
5aa93685cb85143c73f36ec46290af9b214d12f8
Link:
https://www.unpac.me/results/a264e650-8ee5-4404-8979-6cc91de8c8d7/
SH256 hash:
d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
MD5 hash:
86c0573a6920ba2f12101ca3c042358c
SHA1 hash:
fcd1bcb3d3b932133a5f9749934dc32d6a822ae5
Link:
https://www.unpac.me/results/a264e650-8ee5-4404-8979-6cc91de8c8d7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 960b4b5eb5eeceded16d6e616759ce5996683186bd798ca51d142ab133502f7d

Formbook

Executable exe d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 960b4b5eb5eeceded16d6e616759ce5996683186bd798ca51d142ab133502f7d
  
Dropped by
SHA256 940a2cdbdadc74ac068f9d7beac660d2165b9f205e2e0fb0d20e6e83778dd752
Cape
Cape
https://www.capesandbox.com/analysis/371156/
  
Dropped by
MD5 d3fb84b3e1cb9af442ac7a52f5cef80b
  
Dropped by
MD5 5268ce98e1e1179ce49375f3b7c76b0b

Comments