MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fad8f6a07c20b0594611901f079ab4ad87c3c0a3ff5e776eee1f86b4b56abd4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fad8f6a07c20b0594611901f079ab4ad87c3c0a3ff5e776eee1f86b4b56abd4c
SHA3-384 hash: 1dd02f1a5fce1febe8a0c8e582e230daf7ad988ebb986997a4591dccff80aafc5eac97173b556ccda3e14cb6ae9844e3
SHA1 hash: 7182e3fcb5f5e443c3cef6c522417b1c0d65a806
MD5 hash: 0616997ac4983529207a888792c0b290
humanhash: september-helium-november-victor
File name:PROFORMA001THK.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:779'264 bytes
First seen:2021-05-13 19:59:32 UTC
Last seen:2021-05-14 05:46:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 146e24575086448ba589e1755a927ce7 (5 x Formbook)
ssdeep 6144:7Lq9pRaKkljgt+WQcDrLtXfR4CpNBpUxwQhr+Ds0NXi6+TMSnnJvkCx2XYH0yNvF:7Lq9pgtxyXl7E+fNIJV3HVNRs
Threatray 5'271 similar samples on MalwareBazaar
TLSH 1CF49D997E1448E1D0568438C9638676E2B27C055E2D934FE3A4FBBEDF332919D1A323
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/156292/
Detection(s):
SecuriteInfo.com.Trojan.Siggen13.26903.28986.20589.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a process from a recently created file
Sending a custom TCP request
Launching a process
Sending a UDP request
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/781379
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 413776 Sample: PROFORMA001THK.exe Startdate: 13/05/2021 Architecture: WINDOWS Score: 100 45 www.howtowhittle.com 2->45 67 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->67 69 Found malware configuration 2->69 71 Malicious sample detected (through community Yara rule) 2->71 73 5 other signatures 2->73 12 PROFORMA001THK.exe 2 2->12         started        signatures3 process4 file5 41 C:\Users\user\AppData\Local\RfZn0p.exe, PE32+ 12->41 dropped 43 C:\Users\user\...\RfZn0p.exe:Zone.Identifier, ASCII 12->43 dropped 15 RfZn0p.exe 2 12->15         started        process6 signatures7 87 Multi AV Scanner detection for dropped file 15->87 89 Maps a DLL or memory area into another process 15->89 91 Sample uses process hollowing technique 15->91 18 svchost.exe 15->18         started        process8 signatures9 53 Modifies the context of a thread in another process (thread injection) 18->53 55 Maps a DLL or memory area into another process 18->55 57 Sample uses process hollowing technique 18->57 59 2 other signatures 18->59 21 explorer.exe 4 18->21 injected process10 dnsIp11 47 www.movemusica.com 64.29.151.218, 49774, 80 INFB2-ASUS United States 21->47 49 www.transitionwithdrola.com 64.111.127.209, 49752, 80 DREAMHOST-ASUS United States 21->49 51 15 other IPs or domains 21->51 75 System process connects to network (likely due to code injection or exploit) 21->75 77 Performs DNS queries to domains with low reputation 21->77 25 RfZn0p.exe 1 21->25         started        28 cmd.exe 21->28         started        30 cmstp.exe 21->30         started        32 2 other processes 21->32 signatures12 process13 signatures14 79 Maps a DLL or memory area into another process 25->79 81 Sample uses process hollowing technique 25->81 34 svchost.exe 25->34         started        83 Modifies the context of a thread in another process (thread injection) 28->83 85 Tries to detect virtualization through RDTSC time measurements 28->85 37 cmd.exe 1 28->37         started        process15 signatures16 61 Modifies the context of a thread in another process (thread injection) 34->61 63 Maps a DLL or memory area into another process 34->63 65 Sample uses process hollowing technique 34->65 39 conhost.exe 37->39         started        process17
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fad8f6a07c20b0594611901f079ab4ad87c3c0a3ff5e776eee1f86b4b56abd4c/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-05-13 19:59:21 UTC
File Type:
PE+ (Exe)
Extracted files:
33
AV detection:
22 of 29 (75.86%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7lmpnid4ecyfsrqrsapqpgvuvwd4hqfd75pho3xod6dljnlkxvga._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3638ac885ef63f3b5bfadd95b0f43c34c3854e2483adde873b3d5fca7a831632
Formbook
38b6a40d2eeddf38695294c57971fc2efab81fea95100260a2003baa13616b83
Formbook
63b94415ccf2fabff3be3a811ded9a5306d68ac197adc07d7c2be3b313e8a665
Formbook
6657aeabd5ded830361aad9112749d785fc0fbe46121daeb7acb23cd841274ed
Formbook
86071c5800d553ea0cac697f9188a7b592aa9336bf59302545b14aed8b13ce11
Formbook
a1783d0a9f787d819b960b55c8ebfb227459bcb7daab55996720e8279751736f
Formbook
a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570
Formbook
a9c3d37d324e9b6a0ebf9f9369c68cc288117edc4657d086b0fbc0cbafee9e64
Formbook
f2a1b48f82208d3d1bf4e613fd7c6a16f63c96ebb2c31ed502ec67cb6768b2f6
Formbook
f96442a26d160132827a3b109acadaf4aad9dab625939103677cc93783c93ea6
Formbook
+ 5'261 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210513-6btzq9va62/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.sembrangpoki.com/epns/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fad8f6a07c20b0594611901f079ab4ad87c3c0a3ff5e776eee1f86b4b56abd4c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/156292/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-13 21:01:34 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
2) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
3) [C0026.002] Data Micro-objective::XOR::Encode Data
4) [C0030.005] Data Micro-objective::FNV::Non-Cryptographic Hash
6) [C0045] File System Micro-objective::Copy File
7) [C0052] File System Micro-objective::Writes File
8) [C0040] Process Micro-objective::Allocate Thread Local Storage
9) [C0017] Process Micro-objective::Create Process
10) [C0038] Process Micro-objective::Create Thread
11) [C0041] Process Micro-objective::Set Thread Local Storage Value
12) [C0018] Process Micro-objective::Terminate Process