MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4688e6e5455d4601d2988f805b8e1652def668899185a6c179827f13e72941a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4688e6e5455d4601d2988f805b8e1652def668899185a6c179827f13e72941a
SHA3-384 hash: 3f1106eafcde133637f7745ee03abd71dea5850bde8207598fb8b7ec6d7cd2dd4eab145e0c740d5b6ad3e1bd4931d974
SHA1 hash: b52a3238b8ee90cac76e9697fac845aa55d8e122
MD5 hash: c409d1a3f0d5d901c207990858a922d3
humanhash: utah-louisiana-nine-nine
File name:Midnight.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'853'712 bytes
First seen:2022-05-20 13:42:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 49152:Tdfss+0DMmRufGCiL5ud1OfWgppNgVZf:TVRZ2fGDI6WupNgVB
Threatray 29 similar samples on MalwareBazaar
TLSH T16085333A23362C74DE75CC7EAD5B940923434366551CBFAB4320AE7AFBDD501A2EC192
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0f0e8e1caeac4f0 (2 x Formbook)
Reporter JaffaCakes118
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
321
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Midnight.exe
Verdict:
Malicious activity
Analysis date:
2022-05-20 13:41:20 UTC
Tags:
evasion trojan stealer
Link:
https://app.any.run/tasks/6052342c-5a65-42e4-a5ef-2fc394e36cc4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/273069/
Detection(s):
Win.Packed.Crypterx-9940465-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% directory
Creating a process from a recently created file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Moving a file to the %AppData% subdirectory
Creating a window
Launching a process
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Sending an HTTP GET request
Creating a file
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/19248/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer clipbanker control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62879ae76eb3ff3263159a71/reports/eb4d592d-e9d3-405c-b35d-9e296d9cc626/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/55bd27d6-2a3d-447a-86c4-af082741cfdb
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/998623
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Injects a PE file into a foreign processes
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 631123 Sample: Midnight.exe Startdate: 20/05/2022 Architecture: WINDOWS Score: 100 43 Antivirus / Scanner detection for submitted sample 2->43 45 Multi AV Scanner detection for dropped file 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 2 other signatures 2->49 7 Midnight.exe 10 2->7         started        process3 file4 31 C:\Users\user\...\skazkalzt_crypted.exe, PE32 7->31 dropped 33 C:\Users\user\AppData\Roaming\Sihost67.exe, PE32+ 7->33 dropped 35 C:\Users\user\AppData\...\Salvity_crypted.exe, PE32 7->35 dropped 10 Salvity_crypted.exe 1 7->10         started        13 skazkalzt_crypted.exe 1 7->13         started        15 Sihost67.exe 16 2 7->15         started        process5 dnsIp6 55 Multi AV Scanner detection for dropped file 10->55 57 Contains functionality to inject code into remote processes 10->57 59 Writes to foreign memory regions 10->59 19 AppLaunch.exe 15 3 10->19         started        23 conhost.exe 10->23         started        61 Allocates memory in foreign processes 13->61 63 Injects a PE file into a foreign processes 13->63 25 conhost.exe 13->25         started        27 AppLaunch.exe 13->27         started        41 api.telegram.org 149.154.167.220, 443, 49730 TELEGRAMRU United Kingdom 15->41 29 C:\Users\user\AppData\...\csrss.exe (copy), PE32+ 15->29 dropped 65 Creates multiple autostart registry keys 15->65 file7 signatures8 process9 dnsIp10 37 ip-api.com 208.95.112.1, 49738, 80 TUT-ASUS United States 19->37 39 192.168.2.1 unknown unknown 19->39 51 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->51 53 May check the online IP address of the machine 19->53 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4688e6e5455d4601d2988f805b8e1652def668899185a6c179827f13e72941a/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2022-05-20 13:43:14 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 41 (53.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2rui43sukxkgahjjrd4alohbmuw66zuitemfu3axtat7cptssqna._file
Verdict:
malicious
Similar samples:
0c20d0148493e6494e468c0888664a6858ed5120a13d4e938f5cf6bc9d009f57
Formbook
26dde4b7d7de752c625f0144190ab3f7a265d9f140d0d81e6751e56ebd5affc6
Formbook
2dcaabc7567be2d913a8f0df7c972cc19d7ac220889f74342aa40cad5ec80f1d
Formbook
8e69124eef60e3fd34df9b53b91c526e8c4b120d0e56bf8565080362f767284f
Formbook
b6a3b9630a6ed8f626b7fdc083c73a03c57923c1055314bacaa49031c5fa6ae3
Formbook
e2f010306e3aaf1a3838ea5bf9d6abefecd5243e17f0ddef47139a80705aae88
Formbook
f30afc8c92569be98fafc998b231adebfdbd987f2f7300570e1046dbf3004f2a
Formbook
+ 19 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/220520-qz8r5sedc7/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
951e7666425b5751da1c1945e550423238a4017206f7afda0219aeaf765f23a2
MD5 hash:
d01cc6b797bf0149a53ebc3a01a4aec5
SHA1 hash:
42d19b6e24c2d7edf18ce8286250e5d158ff33f9
Link:
https://www.unpac.me/results/271e0779-f069-4627-b1f7-66d3e3d253cd/
SH256 hash:
b58788c80bff299fc6bf5fb8e7d237642ea436110155c29d16d2da67353bf1e3
MD5 hash:
1ecc616748ef4af9c8c3af50369e4bde
SHA1 hash:
223aad55e5710af34de720456a5f9a9242f274fc
Link:
https://www.unpac.me/results/271e0779-f069-4627-b1f7-66d3e3d253cd/
SH256 hash:
f292f8b3eb262a707380cade972a5515f40a0638063c86a206df12bc98afae73
MD5 hash:
0ae67785c2cf5bc6b98f9cd29d3bf720
SHA1 hash:
2e8a99555566f2b9bd64f04361b21d48ed1d0154
Link:
https://www.unpac.me/results/271e0779-f069-4627-b1f7-66d3e3d253cd/
SH256 hash:
d4688e6e5455d4601d2988f805b8e1652def668899185a6c179827f13e72941a
MD5 hash:
c409d1a3f0d5d901c207990858a922d3
SHA1 hash:
b52a3238b8ee90cac76e9697fac845aa55d8e122
Link:
https://www.unpac.me/results/271e0779-f069-4627-b1f7-66d3e3d253cd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d4688e6e5455/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4688e6e5455d4601d2988f805b8e1652def668899185a6c179827f13e72941a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_EXE_Packed_ConfuserEx_Custom
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Custom; outside of GIT
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_NET_NAME_ConfuserEx
Create hunting rule
Author:Arnim Rupp
Description:Detects ConfuserEx packed file
Reference:https://github.com/yck1509/ConfuserEx

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe d4688e6e5455d4601d2988f805b8e1652def668899185a6c179827f13e72941a

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/273069/

Comments