MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf
SHA3-384 hash:	1068f1793e1f597e44de34a7a2c3b54c04d2f277cffd4c0870fa75e552bd2eddce3d9a89a38298efc5132667b7105899
SHA1 hash:	c174cf847aa3e0a06128626c13608a3a5421e0f4
MD5 hash:	4755bdfa1fb87c626856b33c48419201
humanhash:	lion-magnesium-eight-bluebird
File name:	SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925
Download:	download sample
Signature	Formbook Create hunting rule
File size:	283'136 bytes
First seen:	2021-01-19 09:21:46 UTC
Last seen:	2021-01-19 09:59:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b40fe1971bc7ce0542e61a3f70e34f41 (2 x Formbook)
ssdeep	6144:6TPQVEtD4TqL1GmKsKKtZ/eRsRvZtl97P8QlZm:iPQGNL1lK62REv59r9lZ
Threatray	3'554 similar samples on MalwareBazaar
TLSH	EE5401799E40D98FF093C8B05D390B935EBC5A6828151E0DED478ED64B333DC65E2A2E
Reporter	SecuriteInfoCom
Tags:	FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

148

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

RFQ ORDER LIST.xlsx

Verdict:

Malicious activity

Analysis date:

2021-01-19 06:06:59 UTC

Tags:

encrypted exploit CVE-2017-11882 loader trojan formbook stealer opendir

Link:

https://app.any.run/tasks/78b6ad8d-3333-4d99-ba0b-614b99236670

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/112839/

Detection(s):

PUA.Win.Packer.Upolyx-12

PUA.Win.Packer.Upx-4

SecuriteInfo.com.BehavesLike.Win32.Trojan.dc.925.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/584764

Signature

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2021-01-19 06:52:30 UTC

AV detection:

20 of 46 (43.48%)

Threat level:

5/5

Verdict:

malicious

Label(s):

formbook

Formbook

148007b32a311769a958c3f87c6c836b14457f17dbe6a9a0188b0f68b3c30b40

Formbook

41440a2e9db109558bde920dddba0eee3a5f269eef4c0d80eedf6a0bf0445a70

Formbook

82327e5e44156cddbd2dd77556fc746dad24eeaedc11733c82729c7d0c10a1e7

Formbook

86879b01844ab067722fd2ca12bf5a666136348ca9a7f72a33ca42d9707e84d0

Formbook

b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530

Formbook

e2d83de235b73fa4366db562daf7a16884eb632bc00ac8d12d371bdc7a2d1c2f

Formbook

e4e84d03d4cb709d737f9ee3e69b40d797e452d83faa35f0a06bb78a87ad0984

Formbook

f5335d6602e10c13875822341a6044ebff9bdac72b7a0aba66142db66642d594

Formbook

f73c1a2549b119a5de3964cdcbbdbefbaca205e1f149b4d77688a92285b4d20b

Formbook

+ 3'544 additional samples on MalwareBazaar

Result

Malware family:

xloader

Score:

10/10

Tags:

family:formbook family:xloader loader rat spyware stealer trojan upx

Link:

https://tria.ge/reports/210119-a5vplj26ej/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Xloader Payload

Formbook

Xloader

Malware Config

C2 Extraction:

http://www.hitchhikerfab.com/qjnt/

Unpacked files

SH256 hash:

1397f3b8215172641352815668c2c84be22a575ee7c88c71617b016a2871c60b

MD5 hash:

3d56c5c68a25572d43f27abb1a52e556

SHA1 hash:

ebdde88ce798a2939484f69dd570005de2691d2c

Link:

https://www.unpac.me/results/fe273332-0820-4c4e-aac7-0ee5d1751cd4/

SH256 hash:

104fed0b92c1f827c25de61c2fe932862dc222e02486e30039eb42f470d102c3

MD5 hash:

d53716133bc40f8b78b45a3c93a17677

SHA1 hash:

72549806a279dd277b287153f742e99eb7f5821e

Detections:

win_formbook_g0

win_formbook_auto

Link:

https://www.unpac.me/results/fe273332-0820-4c4e-aac7-0ee5d1751cd4/

Parent samples :

d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf
9606fd4c72596ac59b67b738dcb693daff05b981fcd98f56a481dbb749d3b78f

SH256 hash:

d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf

MD5 hash:

4755bdfa1fb87c626856b33c48419201

SHA1 hash:

c174cf847aa3e0a06128626c13608a3a5421e0f4

Link:

https://www.unpac.me/results/fe273332-0820-4c4e-aac7-0ee5d1751cd4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Azorult

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d81f4b6a0b8650415e2c2acfe4ee223f6826b3b6849393f4de2db4f3a814beaf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/