MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7e96b7c6612b709e413bbc8c72796cadbb7ce91ed17ec77d5ba4d4422e729cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7e96b7c6612b709e413bbc8c72796cadbb7ce91ed17ec77d5ba4d4422e729cb
SHA3-384 hash: b43780ebbc9dffa84d0d806dd7222f947799135a7aaff1faf182da6e02e4cb23e1a653c352be8fb580de3d84c4d4996d
SHA1 hash: f8b1197457782ba958fc7178fb838119c8138374
MD5 hash: 5d8702803555ff684424ebd13eda9f47
humanhash: seventeen-east-gee-failed
File name:5d8702803555ff684424ebd13eda9f47.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:371'388 bytes
First seen:2021-04-08 08:18:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 18bc6fa81e19f21156316b1ae696ed6b (51 x Formbook, 24 x Loki, 9 x SnakeKeylogger)
ssdeep 6144:ndQzbPzOFZni219PFibpbvnl6gTaTXIqU2QADiwk+ovQliaIO1Lpt:k+dONwqYfDiwk+ooli6Vb
Threatray 4'560 similar samples on MalwareBazaar
TLSH F384E1337688B662E99D48F18307656143F39F6DD7A258B363D4BAEB4877017FE0A006
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Updated SOA.xlsx
Verdict:
Malicious activity
Analysis date:
2021-04-08 06:07:50 UTC
Tags:
encrypted trojan exploit CVE-2017-11882 loader formbook stealer
Link:
https://app.any.run/tasks/1c5a0c67-9ddf-4cf3-aaa3-766f6f9404f6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133109/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.31307.32288.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/669795
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 383851 Sample: AQJEKNHnWK.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 32 www.thelitigatorsbookclub.com 2->32 34 www.jjwheelerphotography.com 2->34 36 4 other IPs or domains 2->36 46 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 4 other signatures 2->52 11 AQJEKNHnWK.exe 18 2->11         started        signatures3 process4 file5 30 C:\Users\user\AppData\...\bdww7k1w8bk0.dll, PE32 11->30 dropped 64 Detected unpacking (changes PE section rights) 11->64 66 Maps a DLL or memory area into another process 11->66 68 Tries to detect virtualization through RDTSC time measurements 11->68 70 Contains functionality to prevent local Windows debugging 11->70 15 AQJEKNHnWK.exe 11->15         started        signatures6 process7 signatures8 72 Modifies the context of a thread in another process (thread injection) 15->72 74 Maps a DLL or memory area into another process 15->74 76 Sample uses process hollowing technique 15->76 78 Queues an APC in another process (thread injection) 15->78 18 explorer.exe 15->18 injected process9 dnsIp10 38 www.formula-kuhni.com 91.236.136.12, 80 WEBHOST1-ASRU Russian Federation 18->38 40 www.tonton-koubou.com 163.44.185.226, 49727, 80 INTERQGMOInternetIncJP Japan 18->40 42 9 other IPs or domains 18->42 54 System process connects to network (likely due to code injection or exploit) 18->54 22 explorer.exe 12 18->22         started        signatures11 process12 dnsIp13 44 www.formula-kuhni.com 22->44 56 System process connects to network (likely due to code injection or exploit) 22->56 58 Modifies the context of a thread in another process (thread injection) 22->58 60 Maps a DLL or memory area into another process 22->60 62 Tries to detect virtualization through RDTSC time measurements 22->62 26 cmd.exe 1 22->26         started        signatures14 process15 process16 28 conhost.exe 26->28         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f7e96b7c6612b709e413bbc8c72796cadbb7ce91ed17ec77d5ba4d4422e729cb/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 06:58:57 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=67uww7dgck3qtzatxpemoj4wzln3ptur5ul6y56vxjguiixhfhfq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1c2c212dbad3b81d9c6225c3a9f9f6211b10782d228a090f9aa4f038b0270663
Formbook
6657aeabd5ded830361aad9112749d785fc0fbe46121daeb7acb23cd841274ed
Formbook
6a708470ee13d86b51352b69e755a9bcbd2730ecef34133dd1b5ed10b95f56a3
Formbook
7ec78d6c2c919a22185cb0000f2e273d66019b8409a3ca47c819d44cedead22e
Formbook
bd6055810a703f4f0caec388c7cce89661ee9451179dc3abe6261480bda4105e
Formbook
c36c6fd8b9b9f444675b6c97fa1dfa2c2fa05aba6c0f6f4f164e0cf7d1e5bfc7
Formbook
c494dceddfa1c8c6944a93f902c641ab5f99352ba48b81849e576f7da353314c
Formbook
cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
Formbook
f45a023c86d834183f3073c05227d6f40686aef4a71b3893b823be493d7aae83
Formbook
fd0cf58b93453778c312805f74673284da2548389ee866c37cc91431f0ba9cb1
Formbook
+ 4'550 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210408-5gmbfqy98n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.th0rgramm.com/hx3a/
Unpacked files
SH256 hash:
6c4628d2a5d9fe67953d21a7ab0ff49bac94b69fb32b5a1fa94ae8cb71a4d693
MD5 hash:
7c0bf830fa76e4a4d540ef51ec685997
SHA1 hash:
00240d0cbd420b9b54f7795e15d1f6e92ae9d2db
Link:
https://www.unpac.me/results/2f995241-a334-4df9-9c95-a45ef1e303fd/
SH256 hash:
f7e96b7c6612b709e413bbc8c72796cadbb7ce91ed17ec77d5ba4d4422e729cb
MD5 hash:
5d8702803555ff684424ebd13eda9f47
SHA1 hash:
f8b1197457782ba958fc7178fb838119c8138374
Link:
https://www.unpac.me/results/2f995241-a334-4df9-9c95-a45ef1e303fd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f7e96b7c6612b709e413bbc8c72796cadbb7ce91ed17ec77d5ba4d4422e729cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe f7e96b7c6612b709e413bbc8c72796cadbb7ce91ed17ec77d5ba4d4422e729cb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1104224/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133109/

Comments