MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4
SHA3-384 hash: cf06c6ab6d19b935cb949ef26bf072bd1ce869e917b3c91307423f47d31830dfa701c49f4cf0f9175b830442630a1904
SHA1 hash: feec9cf7cd91f7d3ba245388ff4655f5b3aecf21
MD5 hash: e3ef839d952e85b861b7b15faad53f8e
humanhash: quiet-mars-virginia-kentucky
File name:New Order.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:213'082 bytes
First seen:2021-05-05 12:55:15 UTC
Last seen:2021-05-05 13:30:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ea4e67a31ace1a72683a99b80cf37830 (70 x Formbook, 63 x GuLoader, 54 x Loki)
ssdeep 6144:lPXZO8w/cVevBGdetVu/gClscIrMw3I18g77l9f7:TOC8voQVncIrb32tnf7
Threatray 4'976 similar samples on MalwareBazaar
TLSH AC24123537C0D4E7CBA507701D767772F3FA822032441B4BA754BB89BA67A92062F792
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/150608/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.15528.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Sending a UDP request
DNS request
Sending an HTTP GET request
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 03:20:50 UTC
AV detection:
33 of 47 (70.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2nibpb3vcmsomfn5cpwyaqltmd55ovmdqvtcvq2mkgzuqaxzxhka._file
Verdict:
malicious
Similar samples:
06bb9855bfa4a2ea3480925204f83b767ee01a9a59c638910a6b04cdd8cc43b6
Formbook
321bb25b6b169c5cb108a2b1a16f5fb82307059d5876201e19cc93bf425d2616
Formbook
5191f6a6fc1500632342d4820e8abd7c1d32c105f56399a2cece4e4db1fa77bb
Formbook
6c8d9b097832fec5088306fabfeb26cf5aa0c67153134f4c5e356cee935f871e
Formbook
727bc43e3d9cdf3e79c2232cf3f647bdf94ad2012c31403434c17e5bbeb3c339
Formbook
80b056a8c2fee08fd3361a8a271dea407425ca335275d49f81a1c50a06d9ed98
Formbook
ab95bc3c40647b2b700cdb9aba76b6de220fd528fd194e6071c1747df6cb78ce
Formbook
e091222f766082c33c0606405115206cb2d915929dfe2ac899b1945d6442c512
Formbook
e9f37a053f32c4f4732ba0ff24dba4d0a57a4e2dc8e8f1698e5601385371ce8e
Formbook
fb2b5f7805523f8e675cf06f611c9429e657f4f0af111bf4959627e6183ddc48
Formbook
+ 4'966 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210505-n68danm82x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.onyxcomputing.com/u8nw/
Unpacked files
SH256 hash:
275285c37d855d300ec1da03896538f21b1cebad07a63bc50861d0cf0050ac79
MD5 hash:
0aae4bc5f5cf93acb20784cd7df703dc
SHA1 hash:
9bfd9be2d3f92636b86e658684fc1cc25f18e611
Link:
https://www.unpac.me/results/49d9325e-6838-49a6-b136-a5fe9dd25984/
SH256 hash:
d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4
MD5 hash:
e3ef839d952e85b861b7b15faad53f8e
SHA1 hash:
feec9cf7cd91f7d3ba245388ff4655f5b3aecf21
Link:
https://www.unpac.me/results/49d9325e-6838-49a6-b136-a5fe9dd25984/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150608/

Comments