MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802
SHA3-384 hash: 0680d6df7fc5ebcb14f52ba80061ec6e7489dab0e1458e932c16374b59597728048bd589f3395e0b666f5d4729271c5f
SHA1 hash: 19433ceeaae0f6b678f77e8494a39de9e9d4f870
MD5 hash: 4a640b5abfd52dc70eb962bf9f250714
humanhash: blue-kansas-friend-happy
File name:4a640b5abfd52dc70eb962bf9f250714.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:512'000 bytes
First seen:2021-10-27 16:59:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:loIQZS4/ZF0145hcJnwO88qariw5fBbP7tJOsDRYG:SIQZhfY8hcinQPpbPxJLDR
Threatray 10'852 similar samples on MalwareBazaar
TLSH T11EB4DF05F2618235F9394A3644D37691CE6CAC8554008A856BBE7B8F3F772D08F1EADE
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200665/
Detection(s):
SecuriteInfo.com.VHO.Trojan-Spy.MSIL.Noon.gen.28503.23498.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Delayed writing of the file
Creating a window
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61798596a9d585e6d53b9304/reports/a10c2b4e-d022-4671-8375-32fe523f6588/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b35784d-92c7-4a2a-abf8-920beac84c60
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/877965
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 510401 Sample: CtTYTpaAKA.exe Startdate: 27/10/2021 Architecture: WINDOWS Score: 100 31 www.qywyfeo8.xyz 2->31 33 www.mask60.com 2->33 35 mask60.com 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 7 other signatures 2->49 11 CtTYTpaAKA.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\CtTYTpaAKA.exe.log, ASCII 11->29 dropped 61 Tries to detect virtualization through RDTSC time measurements 11->61 15 CtTYTpaAKA.exe 11->15         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 18 explorer.exe 15->18 injected process9 dnsIp10 37 www.rdoi.top 104.233.161.241, 49786, 80 PEGTECHINCUS United States 18->37 39 www.sosoon.store 18.118.119.183, 49811, 80 MIT-GATEWAYSUS United States 18->39 41 11 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 cscript.exe 18->22         started        signatures11 process12 signatures13 53 Self deletion via cmd delete 22->53 55 Modifies the context of a thread in another process (thread injection) 22->55 57 Maps a DLL or memory area into another process 22->57 59 Tries to detect virtualization through RDTSC time measurements 22->59 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 17:00:06 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1d3c91b0ec0e3b039a78c042eec94a3aebbe5da4d6e61cf7b7e54de22084d4a3
Formbook
37669e84be570d6748f6bae3adbaf41a969894111073837204f526a1f8c8dad9
Formbook
832c65a202ec1c69a8297af3d2fc3d233ac65b7c2c670f30d0694089601c9cfe
Formbook
9136c283e5029c2f073b706014f6f73b67ead84450267cb5ce0dd26cbcecaa25
Formbook
a104d6d98afd1eca774c2b8b12aee19bbc52216a358d9bf00ebfb503ef8e553d
Formbook
aaf0400f83fd271800e1f4cb50fab438958eb3771a6b6a9401c5fa66c1c5b956
Formbook
b16670d7ab7fc43029ef6033d5bf6b8a3ad78f09fefed66ec6351c7eac0a53f8
Formbook
ba22bb07f3ef12877682493d25ed29cf6e2ca6c9ce2bc9527396a7bae00ec578
Formbook
c0363e690238ce1be218baa1c66a3fe647df3740da9448788945c6863ac6b07c
Formbook
d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636
Formbook
+ 10'842 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:fqiq loader rat
Link:
https://tria.ge/reports/211027-vhzkcshcdm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.esyscoloradosprings.com/fqiq/
Unpacked files
SH256 hash:
36962a581f91e7f4920e3da5c34a4753efa23e5dd51822b52fa726c44aa3be51
MD5 hash:
0fcc97c13416adb52d58364646db8ef8
SHA1 hash:
8fba0404952912070ee5ae0ac760519f498daf0f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/39c475ce-a8d7-4e8e-ab8e-bf3d68e50806/
Parent samples :
6ffe756ce71f1457d7dd480357f3545f123b750fc4bf30683b59887d491948a7
092be1f456b0c24d932d6c4e4c44cfd0c9abc6c0418bf1567e67826cb51aef14
91a166f9a29ad832c9640078210a47e5afa928ab1a79a7b40d3b358e9c8bc5d5
9136c283e5029c2f073b706014f6f73b67ead84450267cb5ce0dd26cbcecaa25
89b049bc712096512185d1607a9318c074885b2d5b529e0985dc92cdd94d1f51
d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636
ba22bb07f3ef12877682493d25ed29cf6e2ca6c9ce2bc9527396a7bae00ec578
4340e97182604cbe78767ba17c66b1d106d7e28855fc5ef3737142b41656cd9c
6d2abaaa61c35b3bc1cf8ae531dd9505406379b70f414f806974d0202365d14e
1d3c91b0ec0e3b039a78c042eec94a3aebbe5da4d6e61cf7b7e54de22084d4a3
aaf0400f83fd271800e1f4cb50fab438958eb3771a6b6a9401c5fa66c1c5b956
832c65a202ec1c69a8297af3d2fc3d233ac65b7c2c670f30d0694089601c9cfe
58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57
36465b5c8b0baa57cc7d26405d290bff57488f216c72654b2773e506dc6646df
b16670d7ab7fc43029ef6033d5bf6b8a3ad78f09fefed66ec6351c7eac0a53f8
37669e84be570d6748f6bae3adbaf41a969894111073837204f526a1f8c8dad9
c0363e690238ce1be218baa1c66a3fe647df3740da9448788945c6863ac6b07c
a104d6d98afd1eca774c2b8b12aee19bbc52216a358d9bf00ebfb503ef8e553d
0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802
060c2f164a53cf74817b9b2f176d770dbde8b1ef71fe5322abf9ae8197232b7d
43d01d2eb5232707d644d1ea624c347b98220adbbdb7a8bd625814a5b971dd2d
37fe8e29a0b03c101b7de698fe335669bd98d2f4afdbe202bca00ceef540bd5d
88162d7f1cc5091fe38963f350017010d2ff7167e4d50c84599ad9f3b29a1a2d
5fa1ff89c81ecaec98e5995fbfe4df5caaa1da2f514d2deefff5ea91938d579f
b2663af445ff18476795d3462841a45488a9f2fd53c92d0c798e2e24892e10ae
cd9c2941f474d97ebaf1b88641fa3153958c8936939b77e0a62fb19fa488b25f
be6f833816e4dd59791654e138d793e1bfb6bfe016f34ae63b9b3e2f6106fc55
1764a3523eb73d0b632820c013bb2a723fbb3779c7eb59c7e0b67cd488deda6d
f0a7f92f4fa639da7f829e82242a21aa8861bc98f1783b51638e04dc148e81b5
92dfbdc903edcc919f426dc689d4461d354d15d77bf7f865db884f5de11d1253
29e85e2310c309eb1fc9939287177b02a8b4b096c2b600b2bd47a8e1acb58f36
28903cad5faee3c56985c052982d83527166253a85a74315ecca8d6dc17e6a59
ff50a282945cb9b5a738f97aa08714f874469eaa4ed79fcd0c5fd0c12d6a4be8
3d50a61d513475fc02d1685b3e4af3d10c2b23136c41703552e0e41b35fbeae9
7e6b468c991367b78ad9d9a9437ab4a4efd789203038a75e687cc3beaa346dd7
ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb
19e393a62338d6cc292c4aadeab10121a453635fdb5fe291d295a3a6fc6ef712
d042461c8232d82419b3c843757d65e0e3ccfcdaf7d12c03c7e027f5b8639854
7a1a96acb6fbf74b821d7cad25b8912cbb97ea2eb4b847289cc0486705984fda
6b9d128b143bc2ec8b72ac36891a5b12887f182de44ae5e367c0a486b774a59f
12c431c9695b91725092b2261e1f4d251d682fdc0784ae3c7df3a7a478f194f6
dab06b4d2862c59c9a454d29852d9bf4a15462d660ff65e0a29d987d6b8f320c
63c0f55aa5ab5b3cd05a335deb13a29dee7f1bc41b860c716239c44a2bef39f4
7538dd54090aa1debe47b52503cf0099fe2b2839f08ff282dacd31734a0bcb9a
55b588d9d763bee7e3a03b6bb027af6ccd779fadd9022696d31e102a97f1b18b
dcd2e00fc2a47d732fd3d0d79fd224caac8bee02053a1b02ba4e51e022a949f9
bd7cddd657e0144076352a60664ca134c2ddee8ffe8da70793d5b97f17cf9318
933a2e4716b395f6fa6aed9ae203901742b7993fdb29d5b2f56a3c82f80fc095
b30e2fa345e02eecf58f3672cab4f07b4c6f84712c7dee9a64ca3005ac7bf255
a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
821d7489d8ef08b8ebdfb08350ac7cf3ae8ac918b4a1aa4bcbbcc0ffbd668059
SH256 hash:
dfe5e51caaba1c68aac265a7f20015181c67eee1b4248fe4be78359ff5eb318e
MD5 hash:
770c5e7948a797a0cdb9c44691e564a5
SHA1 hash:
fb6b30612195dd06196da0a10afcd46520a54247
Link:
https://www.unpac.me/results/39c475ce-a8d7-4e8e-ab8e-bf3d68e50806/
SH256 hash:
4d1ee061c817ea30ca4e461a4f44388662c1c1c2775be2b323858ddbc1679b35
MD5 hash:
1b6d3d31872537cc611ff4322ffc1099
SHA1 hash:
0108adafb207ce044bfb3f7933da45594c545bee
Link:
https://www.unpac.me/results/39c475ce-a8d7-4e8e-ab8e-bf3d68e50806/
SH256 hash:
0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802
MD5 hash:
4a640b5abfd52dc70eb962bf9f250714
SHA1 hash:
19433ceeaae0f6b678f77e8494a39de9e9d4f870
Link:
https://www.unpac.me/results/39c475ce-a8d7-4e8e-ab8e-bf3d68e50806/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0e636b89393a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/200665/
  
URLhaus
https://urlhaus.abuse.ch/url/1719319/
  
Delivery method
Distributed via web download

Comments