MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0df7f1a2806492968e56fab8298a3285a1663c83827cf5f9ab053aee46675a0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0df7f1a2806492968e56fab8298a3285a1663c83827cf5f9ab053aee46675a0c
SHA3-384 hash: 2940001b85bc4de1b651be59eed58727f19c455c7acfc4426ab2196c4443d203062da5d5d0df0962ff5f0dcc8e7d9970
SHA1 hash: 64387a06fbad1e4c3f9db91f3e21f2edfbf70815
MD5 hash: 43f4cb99c87c5cb01705ae73fcd0680b
humanhash: floor-missouri-mike-august
File name:SecuriteInfo.com.W32.AIDetectNet.01.23560.555
Download: download sample
Signature Formbook
Create hunting rule
File size:652'800 bytes
First seen:2022-05-11 11:59:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:riGupKpy66wk4jmpcxwGVmDT2Uhkv0Zk4OFO6U3LQlVt/Dip:rixsQ66wxjmpUpVmDaUOv0u4LQlHi
Threatray 15'370 similar samples on MalwareBazaar
TLSH T1B6D4021CB3E7DA12C2BD2F36C8F5442557F8FA499137E30E26CC260D6A0279B49527A7
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon e0d2e25945ba9cf0 (15 x AgentTesla, 9 x Formbook, 7 x Loki)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
254
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/269676/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.23560.555.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/627ba55dd4bfd83491c713ce/reports/0ee29aea-3612-4c76-83f2-3bb77587e511/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/917b00d7-9f12-449c-890e-0f909fd2ed7e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/991797
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0df7f1a2806492968e56fab8298a3285a1663c83827cf5f9ab053aee46675a0c/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-05-11 08:16:54 UTC
AV detection:
2 of 41 (4.88%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bx37diuamsjjndsw7k4ctcrsqwqwmpedqj6pl6nlau5o4rthliga._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2436139a182cd467b9669673ef9953bd25337fbb083995a7b69534bcfb75e9d5
Formbook
5a6ac40a3c393c4a3feff2030b34b6493215f0e855588f585fdb768529a3deae
Formbook
898b47cb2e4d16a7325de16aae14c3c66894467ece923e706c186ee9ab75799b
Formbook
c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
Formbook
cb211078773205b00dfbb29da746dde5cd2a3c25f8e141da84fa8d07379ed778
Formbook
e473eec04a43a280723367337e0ff1083ed5f7dea858173dff9ff4c6c8a89029
Formbook
fed1f0c660904ecb7465c29594741e048485c6bdd792f8b745e9f12a9b40367f
Formbook
+ 15'360 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:ges0 loader rat
Link:
https://tria.ge/reports/220511-n6a4cabban/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
38ae22032e6177fecf2363688ebb7d87feaaf061dc85d510f225751aaa74539e
MD5 hash:
879d4cc7fcb522cec544e5ca271ccb64
SHA1 hash:
29a1ffe01fad0ff25c6d31b2d0857465a4c3b468
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/6ea27579-7483-4646-b9c5-6d4db2b2a1ba/
Parent samples :
98f4f1c128751018e663a09193d697540dafedb9b10c9ab0872a6ec34700e5c9
0df7f1a2806492968e56fab8298a3285a1663c83827cf5f9ab053aee46675a0c
534d820868823c23aac058857ce3d8574f4646e02932405aba96e33f21bb60ff
595a2a2d6f22dccd00cb3913a64ab5557babd5914aa896ffed9af089c48ccc14
2919e76dced53555f70e001344ad6077e46c17a17c6a7551f606fd2be87f6042
8b4f02e9e31e40131166738b0894f856ceda8f1e836d53bd282b1f88b3799c18
839e40ef075f127658162da621f67ed6dd8619b6ad48d9f6d0a06756adbb0e2e
993f460a289cf97fdf275eec6b4d1f61fda5f252637f445747cb4d5ee04527d2
SH256 hash:
c206122a7336385be557580c114ac0923192f61bc8f77aa58c898135438399f9
MD5 hash:
6c9e813248a01432890c476813d210b8
SHA1 hash:
fd54aa3af58fc3a88cb3fd6753d773cd6c51b7f8
Link:
https://www.unpac.me/results/6ea27579-7483-4646-b9c5-6d4db2b2a1ba/
SH256 hash:
9b6b707b68e9662fc66894e556a927bf1aff5e8b0f19ac2f8b89bf8e9a2138d8
MD5 hash:
51990c3e3eba3882fe0ee81eb7c1348e
SHA1 hash:
ea3a951d0a936aee03918ed81e6b4f9a557dd8ab
Link:
https://www.unpac.me/results/6ea27579-7483-4646-b9c5-6d4db2b2a1ba/
SH256 hash:
1563a9f43877d053f3264d2ed162cc6c155c4b2c1c14db777703db9f396e9039
MD5 hash:
2c045f02c1432c0d3c6c9b2b886a21de
SHA1 hash:
ab367e51430f76755ec81d6645e484141b67f732
Link:
https://www.unpac.me/results/6ea27579-7483-4646-b9c5-6d4db2b2a1ba/
SH256 hash:
0df7f1a2806492968e56fab8298a3285a1663c83827cf5f9ab053aee46675a0c
MD5 hash:
43f4cb99c87c5cb01705ae73fcd0680b
SHA1 hash:
64387a06fbad1e4c3f9db91f3e21f2edfbf70815
Link:
https://www.unpac.me/results/6ea27579-7483-4646-b9c5-6d4db2b2a1ba/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0df7f1a28064/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/0df7f1a2806492968e56fab8298a3285a1663c83827cf5f9ab053aee46675a0c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/269676/

Comments