MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d21b9e2f6e54cd2b4ddfd1c18a28ed1df3870a06c2775b717144c10e22a2d5fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d21b9e2f6e54cd2b4ddfd1c18a28ed1df3870a06c2775b717144c10e22a2d5fb
SHA3-384 hash: 50a550683a6d9dbd5c32741567ca0fcd93c607507d61829c777e29dd2b24641b7f5d2b8c4d025649f72290228fbb10e9
SHA1 hash: d35030b88b19c3492747a9978ac418afe62ecb43
MD5 hash: 688d59480397f64addffe5524e81dd9c
humanhash: one-spaghetti-uniform-glucose
File name:688d59480397f64addffe5524e81dd9c
Download: download sample
Signature Formbook
Create hunting rule
File size:278'528 bytes
First seen:2021-06-27 21:35:36 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 6144:sEtTqjFAiCkMd/R45GKuSu6NTPm/22+fp3Z5t:sE9ZVJ49vu022hPb
Threatray 6'049 similar samples on MalwareBazaar
TLSH D2440225B2E4D5BBD59213704E788B7AEBBBAE001493521357947F2E3BB11D60B093E3
Reporter zbetcheckin
Tags:FormBook msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168498/
Detection(s):
Win.Malware.Filerepmetagen-9874481-0
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/d21b9e2f6e54cd2b4ddfd1c18a28ed1df3870a06c2775b717144c10e22a2d5fb
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/808620
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
DLL side loading technique detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 441031 Sample: 9An5vKE433 Startdate: 27/06/2021 Architecture: WINDOWS Score: 100 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for URL or domain 2->50 52 4 other signatures 2->52 8 MSIA48B.tmp 20 2->8         started        12 explorer.exe 2->12         started        15 msiexec.exe 2 2->15         started        process3 dnsIp4 26 C:\Users\user\AppData\Local\...\System.dll, PE32 8->26 dropped 28 C:\Users\user\AppData\Local\Temp\graqbh, DOS 8->28 dropped 54 Detected unpacking (changes PE section rights) 8->54 56 Maps a DLL or memory area into another process 8->56 58 DLL side loading technique detected 8->58 60 Tries to detect virtualization through RDTSC time measurements 8->60 17 MSIA48B.tmp 8->17         started        30 www.watdomenren01.net 12->30 32 www.nrcaroofing.com 12->32 34 2 other IPs or domains 12->34 62 System process connects to network (likely due to code injection or exploit) 12->62 20 systray.exe 12->20         started        file5 signatures6 process7 signatures8 36 Modifies the context of a thread in another process (thread injection) 17->36 38 Maps a DLL or memory area into another process 17->38 40 Sample uses process hollowing technique 17->40 42 Queues an APC in another process (thread injection) 17->42 44 Tries to detect virtualization through RDTSC time measurements 20->44 22 cmd.exe 1 20->22         started        process9 process10 24 conhost.exe 22->24         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d21b9e2f6e54cd2b4ddfd1c18a28ed1df3870a06c2775b717144c10e22a2d5fb/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-26 01:01:10 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2inz4l3oktgswto72hayukhndxzyocqgyj3vw4lritaq4ivc2x5q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2080ae2cfe843c0e1754f994b356086718dd6dceedf974ca37b629fb4da817a6
Formbook
33af2b745b27ae79559ac323d88199f92aa9fe8bb4ffec0963d6f622ec17f24a
Formbook
35880c5210af5dca3edc22a693ab5f0cfcec0105cec988d930ab29fe09bd3461
Formbook
3ac891b6f06d85e3caeefbb68d05a33ebabbd4de799ef1e94a9f9cc2ba4163de
Formbook
3d5d3eb3853ff82697da75cf6da041f61f72e06d686010a02d52ebaa63ddca65
Formbook
6120294360629da33cd6f897de16401325be12ae2cd9dcc03857de7e0b4f94e4
Formbook
85c3061712d39d8f6605267663495724d314cd131db20cc9fcbb3027ddf7b628
Formbook
8bb3e6cace7598576464639d7f88d0c4d55919b2e110a341df89a1569ae0d5b7
Formbook
c1a40dbca9d28ac760447f501d812b82312be281ee699fdcc4a6a543077caa3d
Formbook
cfee90218720f31491495dd353027017808fb3b9524d6c86ddfd016a372f627c
Formbook
+ 6'039 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook macro rat spyware stealer trojan xlm
Link:
https://tria.ge/reports/210627-ed3cba9vms/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.withrachlv.com/thl4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/d21b9e2f6e54cd2b4ddfd1c18a28ed1df3870a06c2775b717144c10e22a2d5fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Executable_Converted_to_MSI
Create hunting rule
Rule name:INDICATOR_MSI_EXE2MSI
Create hunting rule
Author:ditekSHen
Description:Detects executables converted to .MSI packages using a free online converter.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Microsoft Software Installer (MSI) msi d21b9e2f6e54cd2b4ddfd1c18a28ed1df3870a06c2775b717144c10e22a2d5fb

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/168498/

Comments