MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123
SHA3-384 hash: 805cdd1182e256833d714fa5c92c377ce2488cedfe60cc18fa8095efcdf30900645ad47637331a591500dcd065dcb783
SHA1 hash: 0f55ce0eecacaba8d777dbac7bb57f9eff64afd9
MD5 hash: 51a5afadf2954fe236a4adc22925cbda
humanhash: carbon-bulldog-pluto-high
File name:Roominglist.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:267'320 bytes
First seen:2021-08-19 05:15:54 UTC
Last seen:2021-08-19 06:10:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f86f9a1397ea2f648b8914df9ad78914 (4 x Formbook, 2 x Loki)
ssdeep 6144:+yY6YydmLLsCiCY3FJxZrNia6K1UGIVXw:+vLwPf3FJxZr0a6K/Ii
Threatray 5 similar samples on MalwareBazaar
TLSH T1AA44E001F3386B95F276C1B4473D64EBF5FF2E72012F59AEA3927D8885B84F00514A6A
dhash icon 1ee745cc4cca671e (1 x Formbook)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Roominglist.exe
Verdict:
Malicious activity
Analysis date:
2021-08-19 05:22:10 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/9af6f85a-e3c3-42b3-accf-3f8aa661599b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180511/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.13017.24354.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c5993221-91d2-4557-9b19-5ab68aa00f62
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/835501
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-08-19 01:04:50 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=45ytgyyp2hm54pxdop7u2bejrivvopvacyfukc2wfhnti7sb2erq._file
Verdict:
unknown
Similar samples:
1736c3f3d740011ba6f6d8f18def38d20f0bcbf88c3f69821db18578bc00590a
Formbook
179d1cf7266d0149e967f7e6829ed485e3bb73e75ffbce4883111f2595845c85
Formbook
9f8faf1ca8d3262940620bcb00487188e8657336cc3cb498ba4ad90ae96a59af
Formbook
d699748002a4cf4d6250e0aca08e4de6e687f39a9f946171a57f573410be3d25
Formbook
e72dab4f75cd19899422ecf38de195bf487f0f9d2b0ccad98c13a48e9d782e97
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ckvl rat spyware stealer trojan
Link:
https://tria.ge/reports/210819-hlhgb6ww7j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.verlan.guru/ckvl/
Unpacked files
SH256 hash:
4841df7d7b3e8dc721d3c54f4fe16bedc2ed099dcbd813807c089674b73f8596
MD5 hash:
d0376de9390f4cfecdff7a60bb5c5da0
SHA1 hash:
98b6d47b75957c111daa94c70edb901ee2e5ab96
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/3b6f4b7a-48a2-4001-88ee-8207d0b4b821/
Parent samples :
253d9cf32609e691876a61247f172b54954d5b081c1c6b449bebccf5dac43c0b
20b597d93eb4d2b2bc15ff25aebb0d171918f99047c31f6eb728833967c8c37f
bd024645f51a267c6d24a75649cb617ac29029d5e9f8a3d8aa8c44b44cf668c9
02b2f3c02cfa488e665ff9e41233993dcfe8f2f02bf79536b1f9c88723ca7c32
25476caca5dd4eca6dea0616d2fdca485866cdd631abda0c410628d5cd9200b9
e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123
SH256 hash:
e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123
MD5 hash:
51a5afadf2954fe236a4adc22925cbda
SHA1 hash:
0f55ce0eecacaba8d777dbac7bb57f9eff64afd9
Link:
https://www.unpac.me/results/3b6f4b7a-48a2-4001-88ee-8207d0b4b821/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.13
Link:
https://yomi.yoroi.company/submissions/e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/180511/

Comments