MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7a09c129dfa6df78f94a517a08da22db5510621dca52f9f1a03ed436a08064c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7a09c129dfa6df78f94a517a08da22db5510621dca52f9f1a03ed436a08064c
SHA3-384 hash: ea1dc86469d708dc27ff2e673192a068a87f389d2b28c6618cae4ae63bd9ef5c4065e235627d2c2ba7d588f84914c50f
SHA1 hash: c9024b3ce7aa9f447913c70d9b01d27b04830b17
MD5 hash: 7ae90045e8e5ab22cade82051868acaf
humanhash: alpha-asparagus-artist-november
File name:slystan.xlsm.com
Download: download sample
Signature Formbook
Create hunting rule
File size:1'901'550 bytes
First seen:2021-04-19 17:26:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 49152:RQYXkvuO4F9How6JrSmKPCY0YK8mq8AQ4oa:RQYVrF922P9mqPAa
Threatray 923 similar samples on MalwareBazaar
TLSH CA95E0763BA46C75CF07EDBC56DB4E34B019E9CD0E922B2409702E96FA356625703AF0
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
slystan.xlsm.com
Verdict:
Malicious activity
Analysis date:
2021-04-18 23:19:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e2612d3d-99d3-4c0c-b6fc-c2a0f1a119c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/138677/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a process from a recently created file
Sending a UDP request
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/687432
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 392662 Sample: slystan.xlsm.com Startdate: 19/04/2021 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus detection for URL or domain 2->45 47 6 other signatures 2->47 10 slystan.xlsm.exe 47 2->10         started        process3 file4 27 C:\Users\user\...\AdvancedGraphicsManager.exe, PE32 10->27 dropped 29 C:\Users\user\AppData\Local\...\zlib1.dll, PE32 10->29 dropped 31 C:\Users\user\AppData\Local\...\shared.dll, PE32 10->31 dropped 33 4 other files (none is malicious) 10->33 dropped 13 AdvancedGraphicsManager.exe 10->13         started        process5 signatures6 55 Multi AV Scanner detection for dropped file 13->55 57 Machine Learning detection for dropped file 13->57 59 Modifies the context of a thread in another process (thread injection) 13->59 61 4 other signatures 13->61 16 explorer.exe 13->16 injected process7 dnsIp8 35 www.innergardenhealing.space 16->35 37 ext-sq.squarespace.com 198.185.159.144, 49742, 80 SQUARESPACEUS United States 16->37 39 System process connects to network (likely due to code injection or exploit) 16->39 20 wscript.exe 16->20         started        signatures9 process10 signatures11 49 Modifies the context of a thread in another process (thread injection) 20->49 51 Maps a DLL or memory area into another process 20->51 53 Tries to detect virtualization through RDTSC time measurements 20->53 23 cmd.exe 1 20->23         started        process12 process13 25 conhost.exe 23->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7a09c129dfa6df78f94a517a08da22db5510621dca52f9f1a03ed436a08064c/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=26qjyeu57jw7pd4uuul2bdncfw2vcbrb3sss7hy2apwug2qiazga._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1baad45cc119fef01aa0a48c0ea82a6dc10c3365d44984d50f94f25866063474
Formbook
21ba0bed0b05a2ce68496e73a5c103fb5b815ac2c77e997f46e5d09666c1c978
Formbook
3633d227baf99bc509e48702b3c68e43a02e0701ba23bfbcd77e9d2f08d1dd2f
Formbook
38acc90cd6d33b61b99cca8cf06781e1bd2ab8ffebc3a33e036eca36037d413b
Formbook
6aca638f8c9405c4c02bb3f2b5f5e5bc9d5596f8c68a57fb99347031415b584b
Formbook
98820c48f104e5644529c8e9b012e7c2de6aca35aca322b342ccd23aefdedc96
Formbook
cccbd0b2d46adeb6d99413af4d5a4492cd530922a09724f04c8fb1e0c47d8326
Formbook
d0a9b26d679362f6fc67a091c445ac8344a70d16eb3219ace55cca8f4132ee43
Formbook
f130539b2d2324246449abb99f5a0effb214feee629b092d48ac63aca14e2ba6
Formbook
fb17b85aa2aeaa59cb6db3e1c6eb68f83a570b5de3f10d3b09dd47a4aebdedea
Formbook
+ 913 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210419-83g7z362ps/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.hollandhousedesigns.design/vns/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7a09c129dfa6df78f94a517a08da22db5510621dca52f9f1a03ed436a08064c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

fcc1e86f860627898bf9e1dd46ab1cb68cb8860e70f7f3ba9059c671e3e4d5b2

Formbook

Executable exe d7a09c129dfa6df78f94a517a08da22db5510621dca52f9f1a03ed436a08064c

(this sample)

  
Dropped by
MD5 fc6afcc167eefa28c7e076343b925d31
  
Dropped by
SHA256 fcc1e86f860627898bf9e1dd46ab1cb68cb8860e70f7f3ba9059c671e3e4d5b2
  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/138677/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-19 18:15:14 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [C0032.001] Data Micro-objective::CRC32::Checksum
2) [C0026.002] Data Micro-objective::XOR::Encode Data
5) [C0045] File System Micro-objective::Copy File
6) [C0046] File System Micro-objective::Create Directory
7) [C0048] File System Micro-objective::Delete Directory
8) [C0047] File System Micro-objective::Delete File
9) [C0049] File System Micro-objective::Get File Attributes
10) [C0051] File System Micro-objective::Read File
11) [C0050] File System Micro-objective::Set File Attributes
12) [C0052] File System Micro-objective::Writes File
13) [E1510] Impact::Clipboard Modification
14) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
15) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
16) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
17) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
18) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
19) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
20) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
21) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
22) [C0017] Process Micro-objective::Create Process
23) [C0038] Process Micro-objective::Create Thread
24) [C0018] Process Micro-objective::Terminate Process