MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f473b9593789f4d0184a1d8f08ebe9187d9c52a3bda939eb4411dba1f060610d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	f473b9593789f4d0184a1d8f08ebe9187d9c52a3bda939eb4411dba1f060610d
SHA3-384 hash:	f62107f80f6687921db9d67ba887fddebed8aa599997f28135564c6671485fe2766619374b194a773d1287e2f5a4b56a
SHA1 hash:	1816debe04f431ade9366eb5021e076be43784bb
MD5 hash:	56eacec64139e167669b3c3163d4b887
humanhash:	yellow-spring-summer-stairway
File name:	March Order 2021.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'060'352 bytes
First seen:	2021-03-03 07:32:13 UTC
Last seen:	2021-03-03 09:39:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:uWE99m9+0HuCDfnYNRq9IDFmsjYzEWLnKRWu3/bO7OqKoe:uAuYnYNRDL0FLKRtVqKoe
TLSH	0F35E26326E8859CEE3A5FF16762508063FAE8B7EB04D64D3EC413476D92DC28D1172E
Reporter	abuse_ch
Tags:	exe FormBook

abuse_ch

Malspam distributing unidentified malware:

HELO: comercialrc.cam
Sending IP: 111.90.145.74
From: Donia Tarek <Donia.tarek@falconfg.com>
Reply-To: mzahar04@protonmail.com
Subject: FW: March Order 2021
Attachment: March Order 2021.zip (contains "March Order 2021.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

March Order 2021.exe

Verdict:

Malicious activity

Analysis date:

2021-03-03 07:51:27 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5a61c05a-8a81-4dc3-b27c-542c1a14782f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/121264/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.27782.164.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/625743

Signature

.NET source code contains very large strings

Binary contains a suspicious time stamp

C2 URLs / IPs found in malware configuration

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM_3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/f473b9593789f4d0184a1d8f08ebe9187d9c52a3bda939eb4411dba1f060610d/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-03-03 07:33:34 UTC

AV detection:

13 of 47 (27.66%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6rz3swjxrh2nagckdwhqr27jdb6zyuvdxwutt22echn2d4damegq._file

Result

Malware family:

xloader

Score:

10/10

Tags:

family:xloader loader rat

Link:

https://tria.ge/reports/210303-wf8kw9dg26/

Behaviour

Gathers network information

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Deletes itself

Xloader Payload

Xloader

Malware Config

C2 Extraction:

http://www.finerchoicehomesllc.com/ezov/

Unpacked files

SH256 hash:

f9d949d2f56c449c5d346bb93ed04d38426f563b022dd179ae330dab46682c3b

MD5 hash:

871e23d748ba756eaab5777708f250f8

SHA1 hash:

c9816d4ab38541aaab9aa3eab7cb4898d0b72e4a

Link:

https://www.unpac.me/results/80898517-4464-406a-b317-053c5006c701/

SH256 hash:

f473b9593789f4d0184a1d8f08ebe9187d9c52a3bda939eb4411dba1f060610d

MD5 hash:

56eacec64139e167669b3c3163d4b887

SHA1 hash:

1816debe04f431ade9366eb5021e076be43784bb

Link:

https://www.unpac.me/results/80898517-4464-406a-b317-053c5006c701/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/f473b9593789f4d0184a1d8f08ebe9187d9c52a3bda939eb4411dba1f060610d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time