MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f81eb28b9cf28b8a5799bf19e2f4e05e789754a23e78baa42ed114d553265020. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f81eb28b9cf28b8a5799bf19e2f4e05e789754a23e78baa42ed114d553265020
SHA3-384 hash: 392da82ad278a6a05119919349217cb25cd72238f50662a4a962786a6956efb54ab7295269c886682987ab4de2393336
SHA1 hash: 62dda3ffdca6b60469d01002ed30016fd1415c31
MD5 hash: ab0f28545d715ef637a548968b62654a
humanhash: pizza-saturn-failed-eight
File name:DOC081621.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:985'600 bytes
First seen:2021-08-17 14:10:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:CDZtWDc9F3nC0Py3gAhKEJbjJEKsVdSTkedYjCCijq8LpeFmf+qJUjFwKqghswtJ:ZgeCj5ij5cmfCTpz2WdT
Threatray 7'972 similar samples on MalwareBazaar
TLSH T1EA2581391BB926A7C065D63EABD18617F04096DF3411AA5764CA0F67B302AC2F7C723D
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DOC081621.exe
Verdict:
Malicious activity
Analysis date:
2021-08-17 14:28:39 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/0cab6bfb-2401-44e3-b3c0-b40e199ece20

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180088/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.998-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1a946a1e-98ee-42ed-b8f8-70e628b7804e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/834442
Signature
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 466907 Sample: DOC081621.exe Startdate: 17/08/2021 Architecture: WINDOWS Score: 100 31 www.nash-arbitrazh.com 2->31 33 nash-arbitrazh.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Multi AV Scanner detection for domain / URL 2->43 45 Found malware configuration 2->45 47 9 other signatures 2->47 11 DOC081621.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\DOC081621.exe.log, ASCII 11->29 dropped 57 Tries to detect virtualization through RDTSC time measurements 11->57 59 Injects a PE file into a foreign processes 11->59 15 DOC081621.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.citestbiz1597689812.com 38.113.1.97, 49744, 80 BIZLAND-SDUS United States 18->35 37 reviewtastiez.com 184.168.131.241, 49741, 80 AS-26496-GO-DADDY-COM-LLCUS United States 18->37 39 www.reviewtastiez.com 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 help.exe 18->22         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f81eb28b9cf28b8a5799bf19e2f4e05e789754a23e78baa42ed114d553265020/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-17 11:34:03 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7aplfc446kfyuv4zx4m6f5halz4jovfchz4lvjbo2eknkuzgkaqa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
25644ff35da89545c702b633182c4ff1f649dd64c9c8249be9afe7090359d87d
Formbook
395171260fafe84055b84b5cae4ddd1d48ae4c49088867ed7a4e58de2394ac55
Formbook
56368dfb68347ec22ba4d8d1d16e1acc9dbf37acf30803ef92f75f27f0a6a6a5
Formbook
b3c5b3cf581d15fcbacf67b4bdba199bfe7089704875746109b3206eb07b99e2
Formbook
d0116b0ea676a655b1d55a2b7a79fb2585c1d04803e9d1d6f9cd1da15f789138
Formbook
d869fa27fd5d5a229609f218572f1625820cb8176ba6c1616714e40d4e6b7897
Formbook
e8be28fabd7cdb2d4e96137dae73bd9b227a86b654c696e9fd401cb37ec68267
Formbook
f0e5f425b27be304c21b4d472ea8f67dc134e1f813ec8405f07389b2af7c58bf
Formbook
f130539b2d2324246449abb99f5a0effb214feee629b092d48ac63aca14e2ba6
Formbook
+ 7'962 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:zmko rat spyware stealer trojan
Link:
https://tria.ge/reports/210817-aj76vjg542/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.reviewtastiez.com/zmko/
Unpacked files
SH256 hash:
7c61e72fd6aa2cf676d03bae723dfb47a8a9099a6e5f2ea301ecc6215f793a6d
MD5 hash:
f65a0ec169a07f89a4e91b44f89f9176
SHA1 hash:
89feb9fba11af1fc0cff9967856ba36ec4a366e0
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/f47605ea-74e7-4dfc-a937-13b38228dbb9/
Parent samples :
f0e5f425b27be304c21b4d472ea8f67dc134e1f813ec8405f07389b2af7c58bf
f81eb28b9cf28b8a5799bf19e2f4e05e789754a23e78baa42ed114d553265020
SH256 hash:
6912e4bedd1288f116e968f0a79d9797f6d6bd24d45a5f10c52e20f9d33b8c61
MD5 hash:
03bde4a82ad64c0f314985232fbca3fa
SHA1 hash:
e8d0b6339e94192eaaca32c812f914e60576dca6
Link:
https://www.unpac.me/results/f47605ea-74e7-4dfc-a937-13b38228dbb9/
SH256 hash:
7e800d231d7d3788b2368199a0d5df88ce64800b199f3f041b0457e024b57a57
MD5 hash:
33dfb208f58f32d63a10f2c43018d04c
SHA1 hash:
047d3c8c235c8c91ef3103388859413fc2ca77fc
Link:
https://www.unpac.me/results/f47605ea-74e7-4dfc-a937-13b38228dbb9/
SH256 hash:
f81eb28b9cf28b8a5799bf19e2f4e05e789754a23e78baa42ed114d553265020
MD5 hash:
ab0f28545d715ef637a548968b62654a
SHA1 hash:
62dda3ffdca6b60469d01002ed30016fd1415c31
Link:
https://www.unpac.me/results/f47605ea-74e7-4dfc-a937-13b38228dbb9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f81eb28b9cf28b8a5799bf19e2f4e05e789754a23e78baa42ed114d553265020

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe f81eb28b9cf28b8a5799bf19e2f4e05e789754a23e78baa42ed114d553265020

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/180088/

Comments