MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 106f2498125d96c6eeb8ba5243494936680e4e01c45c38ea3ffe4ed2e77c73d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments 1

SHA256 hash:	106f2498125d96c6eeb8ba5243494936680e4e01c45c38ea3ffe4ed2e77c73d6
SHA3-384 hash:	a494fc9037f080ff431af554d35e2913995186974c09f8a94e63665441110bcf2f4b88f35e8a180c536ce93d69cae757
SHA1 hash:	0f2ff4ba20b2c1bf81076e70e3d68901740606fd
MD5 hash:	991813c961469bea7d8e781da695f5cc
humanhash:	tennis-snake-india-india
File name:	991813c961469bea7d8e781da695f5cc
Download:	download sample
Signature	Formbook Create hunting rule
File size:	472'853 bytes
First seen:	2022-02-11 08:07:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep	6144:nw82uaAJScHj0N86PENnUr/sBy61btYqzrl7RIwvBBqGirowNUZQFtTGIjfYHLi:28U7v8txzJFqG0ZNUITGKfYHu
Threatray	10'803 similar samples on MalwareBazaar
TLSH	T1CEA4F5912046B769DA150B717B9AC01E4F7719BAAAC2C50F36D57EFAB7AC00CD70312B
File icon (PE):
dhash icon	30f0e0f0e0f0f030 (22 x Formbook, 12 x AgentTesla, 2 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

228

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/240865/

Detection(s):

SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Launching a process

Launching cmd.exe command interpreter

Searching for synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Unauthorized injection to a recently created process by context flags manipulation

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control.exe overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/62061967289e2f3e4fc17899/reports/6a21ae14-1cc7-417f-9d28-557d7300b3e5/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8e49daa2-0194-405d-88d6-8b07e76cbbc5

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/938308

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect virtualization through RDTSC time measurements

Uses ipconfig to lookup or modify the Windows network settings

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

xloader

Link:

https://mwdb.cert.pl/sample/106f2498125d96c6eeb8ba5243494936680e4e01c45c38ea3ffe4ed2e77c73d6/

Threat name:

Win32.Trojan.Tnega

Status:

Malicious

First seen:

2022-02-11 08:08:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 42 (54.76%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cbxsjgaslwlmn3vyxjjegskjgzua4tqbyrodr2r77zhnfz34opla._file

Verdict:

malicious

Label(s):

formbook

Formbook

4d1ac5962b58c0bf6386b85fc1c2029efb0c8d5ccf0054733795eec1ea8b3291

Formbook

705bf99df489a6945a540499bc8c6d7b7564d9a255629e326013d4a85bb77a78

Formbook

d2cc3484cdabe8305bf9afd35530ca1118ca2c308408dc7140c3a94b392b60bb

Formbook

dbc4b30858a2fa9f7001f2347e1cb88f660b8e6651962519b78a7978c6cc2d72

Formbook

f16768c3348ef6a7bde4d734eb1f407fe577d709bca21b0526ded6065be7cc92

Formbook

+ 10'793 additional samples on MalwareBazaar

Result

Malware family:

xloader

Score:

10/10

Tags:

family:xloader campaign:asus loader rat suricata

Link:

https://tria.ge/reports/220211-j1kclseaen/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Suspicious use of SetThreadContext

Loads dropped DLL

Executes dropped EXE

Xloader Payload

Xloader

suricata: ET MALWARE FormBook CnC Checkin (GET)

Unpacked files

SH256 hash:

8a824b9990a37b0418f2135a9eeb0d0d29401557d1859879a839809d26cc5d41

MD5 hash:

69e27a7beda7330fbb867e2805690a81

SHA1 hash:

147c5ef4305764f1e24feaa4e7a718743ead72ef

Detections:

win_formbook_g0

win_formbook_auto

Link:

https://www.unpac.me/results/7b69bde7-64f8-48f8-ab95-fdda64d83c17/

Parent samples :

c5e617b42daec14d7fc20328b8fd9a86395ca742f205d997093f5a8258ba1ecb
3d4166fcaa74af97893767e432c9393e96376ca8da0d1e36114729c7408a1a27
a2ef1147fb83cc34277e15d885f20bbdd4262459f6da12c607f5b5d90bfcb041
2f0668fe2dc8fe9bca5fdd3c62192cd9b86bf236e9559433110e580c842b9fb8
daf64aefe626d474f355e5d42de574fd52bc7f8afe382dce0e174e1cf4b23bf1
053166ff37507398e22d75b5ad58dc5a3732e670c3f86a7e328b489e3675fee4
61b29e885d09ab3ce5fc6f0e08fde19f6d34a926cf58518404105e846ca26310
106f2498125d96c6eeb8ba5243494936680e4e01c45c38ea3ffe4ed2e77c73d6
82f59dc21ab78418dfaa3c6ad30c6c776848db7d32e78dcefc80c30f34099c1a
3b0ea9fb4bcc9cebe136e3d53d6da997fcbc00ac690f5ec9381d75941be38875
35d9792701d7e60dff3464570fe8020c9136e86cffe8f19a4220b61b8eeb5e04
ab90e014c91318ac3616338c4340c31f1639db056f37e44ba794fe53ded87ff2
7535965340e3a37d74b7329bca8f67b82cfb299cef0c4419e8a04aa08f598d78
b6a5f7a958bdb00a9223004f9068976331ada2a513e921ab248ab71c5aebd59f

SH256 hash:

8d88f6dbfadd5812a45a8c170c8e21278cdefeda6cbf7979789c8fb051b95f4c

MD5 hash:

561a15b2dcbf05c9e697c46be6eb203c

SHA1 hash:

85049904bd57fb7b1774ff8e8ba37efa03795722

Link:

https://www.unpac.me/results/7b69bde7-64f8-48f8-ab95-fdda64d83c17/

SH256 hash:

106f2498125d96c6eeb8ba5243494936680e4e01c45c38ea3ffe4ed2e77c73d6

MD5 hash:

991813c961469bea7d8e781da695f5cc

SHA1 hash:

0f2ff4ba20b2c1bf81076e70e3d68901740606fd

Link:

https://www.unpac.me/results/7b69bde7-64f8-48f8-ab95-fdda64d83c17/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/106f2498125d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.