MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a9be6ab91b206446ee357cb8cad8c2ec9fb0727e895b679886fd35bddc4ae9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a9be6ab91b206446ee357cb8cad8c2ec9fb0727e895b679886fd35bddc4ae9b
SHA3-384 hash: 989c9c0eebc2c39e3d0e0c4d93590fa0a0ddd5473613bef14e7f0ac71c74f4dbd4ad0f8fcc7748b0692321950f6c36de
SHA1 hash: 39ca0254267250cc0e0ae237269773a4ff215391
MD5 hash: 13cdc765a53aa6066b491f48f03ddb26
humanhash: victor-montana-nuts-fifteen
File name:5A9BE6AB91B206446EE357CB8CAD8C2EC9FB0727E895B.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:335'872 bytes
First seen:2021-09-14 22:31:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a391fda099714b955a3102eda9e0c1dc (1 x FormBook, 1 x Loki)
ssdeep 6144:3+BfhHJAj3l975QJCvNrVpzDMLCndqYP+QTysDJ0aSBmXGVAgyazeMp:3Ikj3l5gCF7zDMOdPJaaKMGaazLp
Threatray 13'380 similar samples on MalwareBazaar
TLSH T15C6412333BA02176F0321F3C8D8E131ADA7F7C311576240EB5955A8E9979BF64618A3B
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
FormBook C2:
http://aljesvin.com/images/Panel/five/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://aljesvin.com/images/Panel/five/fre.php https://threatfox.abuse.ch/ioc/221958/

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5A9BE6AB91B206446EE357CB8CAD8C2EC9FB0727E895B.exe
Verdict:
Malicious activity
Analysis date:
2021-09-14 22:32:51 UTC
Tags:
trojan lokibot stealer formbook
Link:
https://app.any.run/tasks/9a252201-7a37-4a35-9a7f-8f0aecfb04ee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Xtreme
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187931/
Detection(s):
Win.Trojan.Xtreme-5744908-0
Create hunting rule

Win.Trojan.XtremeRAT-9817317-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a file in the Windows subdirectories
Launching a process
Creating a window
DNS request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Reading critical registry keys
Changing a file
Replacing files
Connection attempt to an infection source
Launching cmd.exe command interpreter
Deleting a recently created file
Setting browser functions hooks
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Stealing user critical data
Query of malicious DNS domain
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Unauthorized injection to a browser process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed rat xtreme
Link:
https://www.filescan.io/uploads/61751275a9d585e6d5370e6e/reports/3ae6006c-e097-48b6-8d9a-f39aa7470e12/overview
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/df1121ed-91e3-4b7b-92a5-c2537c73bb4d
Result
Threat name:
FormBook Lokibot Xtreme RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/851000
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Contains functionality to register a low level keyboard hook
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs Xtreme RAT
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected FormBook
Yara detected Lokibot
Yara detected Xtreme RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 483431 Sample: 5A9BE6AB91B206446EE357CB8CA... Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 73 www.leyogadesmots.com 2->73 75 brusigridete.hopto.org 2->75 111 Multi AV Scanner detection for domain / URL 2->111 113 Found malware configuration 2->113 115 Malicious sample detected (through community Yara rule) 2->115 117 12 other signatures 2->117 11 5A9BE6AB91B206446EE357CB8CAD8C2EC9FB0727E895B.exe 5 23 2->11         started        signatures3 process4 dnsIp5 81 brusigridete.hopto.org 11->81 61 C:\Windows\InstallDir\Server.exe, PE32 11->61 dropped 63 C:\Users\user\AppData\Local\...\95build.exe, PE32 11->63 dropped 65 C:\Users\user\AppData\Local\Temp\739bin.exe, PE32 11->65 dropped 67 C:\Windows\...\Server.exe:Zone.Identifier, ASCII 11->67 dropped 129 Creates an undocumented autostart registry key 11->129 131 Contain functionality to detect virtual machines 11->131 133 Installs Xtreme RAT 11->133 135 9 other signatures 11->135 16 739bin.exe 11->16         started        19 svchost.exe 1 11->19         started        21 95build.exe 54 11->21         started        25 8 other processes 11->25 file6 signatures7 process8 dnsIp9 83 Antivirus detection for dropped file 16->83 85 Multi AV Scanner detection for dropped file 16->85 87 Machine Learning detection for dropped file 16->87 99 4 other signatures 16->99 27 explorer.exe 16->27 injected 89 Contain functionality to detect virtual machines 19->89 91 Tries to detect virtualization through RDTSC time measurements 19->91 30 Server.exe 3 19->30         started        79 aljesvin.com 103.14.120.121, 49737, 49744, 49779 GDRPL-INGoodDomainRegistryPrivateLimitedIN India 21->79 59 C:\Users\user\AppData\...\B52B3F.exe (copy), PE32 21->59 dropped 93 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->93 95 Tries to steal Mail credentials (via file registry) 21->95 97 Tries to steal Mail credentials (via file access) 21->97 101 2 other signatures 21->101 file10 signatures11 process12 file13 119 Drops executables to the windows directory (C:\Windows) and starts them 27->119 33 wscript.exe 27->33         started        36 Server.exe 2 27->36         started        39 Server.exe 2 27->39         started        41 Server.exe 2 27->41         started        69 C:\Users\user\AppData\...\95build.exe.exe, data 30->69 dropped 71 C:\Users\user\AppData\...\739bin.exe.exe, data 30->71 dropped 121 Antivirus detection for dropped file 30->121 123 Multi AV Scanner detection for dropped file 30->123 125 Machine Learning detection for dropped file 30->125 127 2 other signatures 30->127 43 739bin.exe 30->43         started        45 95build.exe 30->45         started        47 chrome.exe 30->47         started        49 3 other processes 30->49 signatures14 process15 dnsIp16 103 Modifies the context of a thread in another process (thread injection) 33->103 105 Maps a DLL or memory area into another process 33->105 107 Tries to detect virtualization through RDTSC time measurements 33->107 51 cmd.exe 33->51         started        53 explorer.exe 33->53         started        77 192.168.2.1 unknown unknown 36->77 109 Sample uses process hollowing technique 43->109 55 svchost.exe 43->55         started        signatures17 process18 process19 57 conhost.exe 51->57         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a9be6ab91b206446ee357cb8cad8c2ec9fb0727e895b679886fd35bddc4ae9b/
Threat name:
Win32.Backdoor.XtremeRAT
Create hunting rule
Status:
Malicious
First seen:
2018-07-17 10:44:10 UTC
AV detection:
26 of 26 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkn6nk4rwidei3xdk7fyzlmmf3e7wbzh5ck3m6min7jvxxoev2nq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
formbook
Create hunting rule
Similar samples:
27b3ee09de06ff54ca8947425175ff4c07f48dc07df976ab42a7990ceeb5232c
FormBook
2a728511ab345b4207ea5959439df12205796548388cc170b427110f9cc247dd
FormBook
46a43e78123a8400e4eecc145ab51509a3cd7baae19f450d5150bb762d0bc34e
FormBook
6d52f253766c4c64e2fb9e5f30a37eaa8833a9d9b669a627d367e9a80518f76e
FormBook
9de1892b227f07e8896b3dfa4d1f8b450bf2af962b1ec34f3075acc7a4187259
FormBook
b8ad131dedee5c7f3164a25f907a69c6f90632f901ecf50a61aa7e31b4c8334e
FormBook
cfee90218720f31491495dd353027017808fb3b9524d6c86ddfd016a372f627c
FormBook
d2d2d97ab2f2c78a230c58a61296504419d0b545c6c6d76193b654dfe9937499
FormBook
d3b19cf0506617e6ac964656ebfe51f1c3066337b66bfdb48bd31b44ff61e7fb
FormBook
e8baf97ad51faed006287d1f01f921df0f677d4f056d35697158d30aa24ace9b
FormBook
+ 13'370 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:lokibot campaign:h25 persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/210914-2fynlsbddl/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Modifies Installed Components in the registry
Formbook Payload
Formbook
Lokibot
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://aljesvin.com/images/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://www.available2.info/h25/
Unpacked files
SH256 hash:
5a9be6ab91b206446ee357cb8cad8c2ec9fb0727e895b679886fd35bddc4ae9b
MD5 hash:
13cdc765a53aa6066b491f48f03ddb26
SHA1 hash:
39ca0254267250cc0e0ae237269773a4ff215391
Detections:
win_extreme_rat_auto
Create hunting rule
win_extreme_rat_w0
Create hunting rule
Link:
https://www.unpac.me/results/6be60865-767f-4b00-8776-00a21391cad5/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5a9be6ab91b2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Xtreme RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5a9be6ab91b206446ee357cb8cad8c2ec9fb0727e895b679886fd35bddc4ae9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxProductID
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifcats referencing sandbox product IDs
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:RAT_Xtreme
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects Xtreme RAT
Reference:http://malwareconfig.com/stats/Xtreme
Rule name:win_extreme_rat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_extreme_rat_w0
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Xtrem RAT v3.5
Rule name:Xtreme_Sep17_1
Create hunting rule
Author:Florian Roth
Description:Detects XTREME sample analyzed in September 2017
Reference:Internal Research
Rule name:Xtreme_Sep17_1_RID2C05
Create hunting rule
Author:Florian Roth
Description:Detects XTREME sample analyzed in September 2017
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/187931/

Comments