MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5d97a568f1962694316e3ac3f5120e1c2aae9d6c6a16f2b9cceed793b4377b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 8

Intelligence 8 IOCs YARA 16 File information Comments 1

SHA256 hash:	e5d97a568f1962694316e3ac3f5120e1c2aae9d6c6a16f2b9cceed793b4377b4
SHA3-384 hash:	767451e91e59245f1b48894c3146418073881c45c1ade93ad92733fd81bb687dd4805715a44593c0294041f48baf8638
SHA1 hash:	f54c207e56dd48d661280b77ade52664c313f554
MD5 hash:	5c3df6dd010f21668ac83b8f7d0e4f91
humanhash:	mississippi-quebec-lactose-louisiana
File name:	101 2043 5770 pdf.exe.xz
Download:	download sample
Signature	FormBook Create hunting rule
File size:	940'988 bytes
First seen:	2024-08-30 05:22:11 UTC
Last seen:	Never
File type:	xz
MIME type:	application/octet-stream
ssdeep	24576:tvtkczBHNQ5nU2NDRwPxhAzjeD6KIHlMAg:tvtkOknUKagzjAIHlMAg
TLSH	T1011533CE81103A1A3FD03869C5EE58BDC24AFEF865E7892C8C4E06D137D5C72D769A52
TrID	85.7% (.XZ) xz compressed container (6000/1) 14.2% (.) QuickBasic BSAVE binary data (1000/1)
Magika	xz
Reporter	cocaman
Tags:	FormBook xz

cocaman

Malicious email (T1566.001)
From: "<sales@sepahanlifter.com>" (likely spoofed)
Received: "from postfix-inbound-v2-3.inbound.mailchannels.net (inbound-egress-7.mailchannels.net [76.74.110.14]) "
Date: "Thu, 29 Aug 2024 22:41:58 +0100"
Subject: "=?UTF-8?Q?=D8=A7=D8=B3=D8=AA=D8=B9=D9=84=D8=A7=D9=85_=D9=82=DB=8C=D9=85=D8=AA?="
Attachment: "101 2043 5770 pdf.exe.xz"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:	MAINICON
File size:	118 bytes
SHA256 hash:	0f8e66b41e930335fa661b03299b12d6e7d8f04e7e35a117cb6966b9d1258497
MD5 hash:	c0b3e66fcb80cecddabf09088b3e8188
MIME type:	application/octet-stream
Signature	FormBook

File name:	LEZSTKJLPWQ
File size:	189'604 bytes
SHA256 hash:	4416d4ea2adbc5c2e4bafa0bd4e7e421dffcb8147129c4b4e671303a948fa67c
MD5 hash:	c1ce033c07ef34edff948817721775ac
MIME type:	application/octet-stream
Signature	FormBook

File name:	hydrated
File size:	0 bytes
SHA256 hash:	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 hash:	d41d8cd98f00b204e9800998ecf8427e
MIME type:	inode/x-empty
Signature	FormBook

File name:	e5d97a568f1962694316e3ac3f5120e1c2aae9d6c6a16f2b9cceed793b4377b4~
File size:	2'148'960 bytes
SHA256 hash:	8d278608d1d1c4c5b6c048020c23351e75203066af1ae1e63c5c5ac0170cd3de
MD5 hash:	5e8e7dd95b3e592a44a3c61b7f8d91f8
MIME type:	application/x-dosexec
Signature	FormBook

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.19503.24984.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66d1573afe69a9e56049ec54

Tags:

Encryption Execution Network Static Stealth Swotter

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint hacktool lolbin microsoft_visual_cc overlay packed regedit remote shell32

Link:

https://www.filescan.io/uploads/66d1573e58cbff3e3abe6f67/reports/7802528e-d4eb-41a2-aa7c-87e1647847a2/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e5d97a568f1962694316e3ac3f5120e1c2aae9d6c6a16f2b9cceed793b4377b4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5d97a568f1962694316e3ac3f5120e1c2aae9d6c6a16f2b9cceed793b4377b4/

Threat name:

Win64.Backdoor.FormBook

Status:

Malicious

First seen:

2024-08-30 00:18:42 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4xmxuvupdfrgsqyw4owd6uja4hbkv2owy2qw6k44z3wxso2do62a._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:kmge credential_access discovery execution persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/240830-f25s6ayaqh/

Behaviour

Modifies Internet Explorer settings

Runs regedit.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Command and Scripting Interpreter: PowerShell

Credentials from Password Stores: Credentials from Web Browsers

Formbook payload

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e5d97a568f1962694316e3ac3f5120e1c2aae9d6c6a16f2b9cceed793b4377b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	Jupyter_infostealer Create hunting rule
Author:	CD_R0M_
Description:	Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

xz e5d97a568f1962694316e3ac3f5120e1c2aae9d6c6a16f2b9cceed793b4377b4

(this sample)

Formbook

exe 8d278608d1d1c4c5b6c048020c23351e75203066af1ae1e63c5c5ac0170cd3de

Delivery method

Distributed via e-mail attachment

Dropping

SHA256 8d278608d1d1c4c5b6c048020c23351e75203066af1ae1e63c5c5ac0170cd3de

Dropping

MD5 5e8e7dd95b3e592a44a3c61b7f8d91f8

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Adm1n 32 USA commented on 2024-08-30 05:27:11 UTC

formbook