MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8d9bb65ea3637fda09488baada0c9b387e0619b7c430b93c8a0fa2d8b489bc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8d9bb65ea3637fda09488baada0c9b387e0619b7c430b93c8a0fa2d8b489bc1
SHA3-384 hash: 8fdf325a8b69e861116ce16923d52ed64bb5b53d6939f1b1517c11d0971fd2a5a4a822cbd74d44eaa54b99fed2e32bfa
SHA1 hash: 06bfc3b47e1ad6a35e10cb4a1edee6c563710107
MD5 hash: 579ba39b6a146080ef6481591440e445
humanhash: sixteen-kilo-edward-chicken
File name:Shipping INVOICE-BL Shipment..exe
Download: download sample
Signature Formbook
Create hunting rule
File size:438'107 bytes
First seen:2020-11-26 13:53:39 UTC
Last seen:2020-11-27 20:02:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 12288:GanGnRPRnPSuPSw4YxX/Jva/qw0kLvDBZNC1J:8PhS7T8v+kW2J
Threatray 321 similar samples on MalwareBazaar
TLSH 4B9413325201E4F7D961023005A466D77D2A6D460E2A164B0F84FFDF3E73A62AF2E75B
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
9
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/105739/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Creating a file
Creating a file in the %AppData% subdirectories
Launching a process
Launching cmd.exe command interpreter
DNS request
Sending an HTTP GET request
Unauthorized injection to a system process
Result
Gathering data
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/548249
Signature
Executable has a suspicious name (potential lure to open the executable)
Hijacks the control flow in another process
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses netsh to modify the Windows network and firewall settings
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 323227 Sample: Shipping INVOICE-BL Shipment..exe Startdate: 26/11/2020 Architecture: WINDOWS Score: 100 40 www.mapnimbis.com 2->40 56 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 5 other signatures 2->62 12 Shipping INVOICE-BL Shipment..exe 54 2->12         started        signatures3 process4 file5 32 C:\Users\user\AppData\Local\...\Prehnite.dll, PE32 12->32 dropped 34 C:\Users\user\AppData\Roaming\...\vjscsvr.exe, PE32 12->34 dropped 36 C:\Users\user\AppData\...\rcxditui.dll, PE32 12->36 dropped 38 8 other files (none is malicious) 12->38 dropped 15 rundll32.exe 12->15         started        process6 signatures7 72 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 15->72 74 Hijacks the control flow in another process 15->74 76 Maps a DLL or memory area into another process 15->76 18 cmd.exe 15->18         started        process8 signatures9 48 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 18->48 50 Modifies the context of a thread in another process (thread injection) 18->50 52 Maps a DLL or memory area into another process 18->52 54 3 other signatures 18->54 21 explorer.exe 18->21 injected process10 dnsIp11 42 www.wtmailer15.com 75.126.100.11, 49769, 80 SOFTLAYERUS United States 21->42 44 wastie.club 95.215.210.10, 49770, 80 NEWIT-ASRU Russian Federation 21->44 46 16 other IPs or domains 21->46 64 System process connects to network (likely due to code injection or exploit) 21->64 25 netsh.exe 21->25         started        signatures12 process13 signatures14 66 Modifies the context of a thread in another process (thread injection) 25->66 68 Maps a DLL or memory area into another process 25->68 70 Tries to detect virtualization through RDTSC time measurements 25->70 28 cmd.exe 1 25->28         started        process15 process16 30 conhost.exe 28->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8d9bb65ea3637fda09488baada0c9b387e0619b7c430b93c8a0fa2d8b489bc1/
Threat name:
Win32.Trojan.Delikle
Create hunting rule
Status:
Malicious
First seen:
2020-11-23 10:00:02 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3dm3wzpkgy373ieurc5k3igjwod6aym3prbqxe6iud5c3c2itpaq._file
Verdict:
unknown
Similar samples:
0468ee9baa41d41562625b8872c782302a324bf03b94f9cfa48060e8d4e8203d
Formbook
4eb8bed8591422f6065c3198d6c3464b14e438f6566003997d98b81d776f02b9
Formbook
5866468d4084d09ee1b47f5135e8968923581b6f6fb5bacaed97b0e3da3a6999
Formbook
5e9315a524e4b99a1f65d7ae1d3127ac7c749ebf10cc9a94acf0643ab3b01222
Formbook
c382d2d33c7036ac95058ef7ab3305b3234394428c28786d8c35f4a049047653
Formbook
c9365a9c17d0b389e953ec604f7a12efb4555f35fe74d8ff99d181e252894a63
Formbook
ccdfc872db6093214d40909b9d4d62e2d6421e57031a04ab95639a1fb003ccbe
Formbook
da32993754454442eef39fdeebd12d93d25299369f4db9c8bf64b6884a07c4ed
Formbook
db4aad17cb58975d3c42dc37b92e7c8bfdce82da52c5eb6a5e87709cf906a684
Formbook
e32674709255fef52ccaf1298ef0e6df8e8493375598775bd8b0d376e30d7322
Formbook
+ 311 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201126-3dcqmwfr4n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.jddq888.com/mqgf/
Unpacked files
SH256 hash:
a60844698cc34a6290ad85616b198567413ee8498052f6b8f0be0b28e6e4ce3f
MD5 hash:
51a7c4a8c0e2b3a9a8ce2f3de857b948
SHA1 hash:
a6057012fa89f06c7e5bc5ee8a83583383dc40cb
Link:
https://www.unpac.me/results/597dd293-8d64-45f8-aa57-b3e229cd0512/
SH256 hash:
d8d9bb65ea3637fda09488baada0c9b387e0619b7c430b93c8a0fa2d8b489bc1
MD5 hash:
579ba39b6a146080ef6481591440e445
SHA1 hash:
06bfc3b47e1ad6a35e10cb4a1edee6c563710107
Link:
https://www.unpac.me/results/597dd293-8d64-45f8-aa57-b3e229cd0512/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d8d9bb65ea3637fda09488baada0c9b387e0619b7c430b93c8a0fa2d8b489bc1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace cf110b2a5010075e0a4bb99c1d8ac5b532b99a4a86cd6b8a97fbd7c727b34edf

Formbook

Executable exe d8d9bb65ea3637fda09488baada0c9b387e0619b7c430b93c8a0fa2d8b489bc1

(this sample)

  
Dropped by
MD5 8dd188896e659e8f46932214f84f2e5d
  
Dropped by
SHA256 cf110b2a5010075e0a4bb99c1d8ac5b532b99a4a86cd6b8a97fbd7c727b34edf
  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/105739/

Comments