🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
SHA3-384 hash: 48d5c97fcd9d915ebf17f6a4dbc2b1c7dc6dd57905062d395ad9f58ec715b268853956b61d9535eda3fc15a68edb3a62
SHA1 hash: 7ad57afccfcd18966c077e68fa3934ee1d9393ed
MD5 hash: 08588477f0297262109025dcdf0a3237
humanhash: mountain-north-happy-georgia
File name:08588477f0297262109025dcdf0a3237
Download: download sample
Signature Formbook
Create hunting rule
File size:994'816 bytes
First seen:2021-11-08 18:44:10 UTC
Last seen:2021-11-08 22:22:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'302 x AgentTesla, 20'721 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 24576:Qm0jlUJGC7ournFLXvVMAPIZz4RcWbxW:Qm0ilV/6AwZs
TLSH T19125BF2327566F48F17A733D806A9C09A3F8F5C7A321DB9F3FE145C91823BC19A26951
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/203353/
Detection(s):
SecuriteInfo.com.W32.MSIL_Agent.CFH.genEldorado.29947.10106.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61897030175442ca93a7e6c3/reports/45291101-52cd-4e19-8f3c-6358dea7c9f7/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/aa4d270e-9d67-4b8e-a279-e0dbd8854a7f
Result
Threat name:
Nanocore AveMaria FormBook UACMe
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/885487
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates an undocumented autostart registry key
Detected Nanocore Rat
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Greenbug Campaign Indicators
Sigma detected: NanoCore
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Yara detected AveMaria stealer
Yara detected FormBook
Yara detected Nanocore RAT
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 517956 Sample: 874ggSRhue Startdate: 08/11/2021 Architecture: WINDOWS Score: 100 69 www.statsheet.xyz 2->69 71 parkingpage.namecheap.com 2->71 73 lockerrollercooller.mywire.org 2->73 85 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->85 87 Malicious sample detected (through community Yara rule) 2->87 89 Antivirus detection for dropped file 2->89 91 17 other signatures 2->91 12 874ggSRhue.exe 15 6 2->12         started        signatures3 process4 dnsIp5 81 www.google.com 172.217.168.68, 443, 49758, 49764 GOOGLEUS United States 12->81 59 C:\Users\user\AppData\Local\Adobe\Adobe.exe, PE32 12->59 dropped 61 C:\Users\user\AppData\...\874ggSRhue.exe.log, ASCII 12->61 dropped 63 C:\Users\user\...\Adobe.exe:Zone.Identifier, ASCII 12->63 dropped 125 Drops executable to a common third party application directory 12->125 127 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->127 17 Adobe.exe 14 9 12->17         started        22 cmd.exe 1 12->22         started        file6 signatures7 process8 dnsIp9 67 www.google.com 17->67 53 C:\Windows\SysWOW64\bin.exe, PE32 17->53 dropped 55 darkworldblackerlo....dumb1.com 5270.exe, PE32 17->55 dropped 57 C:\Users\user\AppData\Local\...\Adobexx.exe, PE32 17->57 dropped 93 Machine Learning detection for dropped file 17->93 95 Drops executables to the windows directory (C:\Windows) and starts them 17->95 97 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->97 99 Injects a PE file into a foreign processes 17->99 24 bin.exe 17->24         started        27 darkworldblackerlocker.dumb1.com 5270.exe 3 4 17->27         started        30 Adobe.exe 10 17->30         started        33 Adobexx.exe 17->33         started        35 reg.exe 1 1 22->35         started        37 conhost.exe 22->37         started        file10 signatures11 process12 dnsIp13 101 Antivirus detection for dropped file 24->101 103 Machine Learning detection for dropped file 24->103 105 Modifies the context of a thread in another process (thread injection) 24->105 117 4 other signatures 24->117 39 explorer.exe 24->39 injected 75 lockerrollercooller.mywire.org 198.46.132.206, 49774, 49784, 49810 AS-COLOCROSSINGUS United States 27->75 77 darkworldblackerlocker.dumb1.com 27->77 107 Increases the number of concurrent connection per server for Internet Explorer 27->107 109 Installs a global keyboard hook 27->109 65 C:\Users\user\AppData\Roaming\...\run.dat, data 30->65 dropped 111 Hides that the sample has been downloaded from the Internet (zone.identifier) 30->111 79 192.168.2.1 unknown unknown 33->79 113 Multi AV Scanner detection for dropped file 33->113 41 Adobexx.exe 33->41         started        115 Creates an undocumented autostart registry key 35->115 file14 signatures15 process16 process17 43 help.exe 39->43         started        46 Adobe.exe 41->46         started        dnsIp18 119 Modifies the context of a thread in another process (thread injection) 43->119 121 Maps a DLL or memory area into another process 43->121 123 Tries to detect virtualization through RDTSC time measurements 43->123 49 cmd.exe 43->49         started        83 www.google.com 46->83 signatures19 process20 process21 51 conhost.exe 49->51         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2021-11-08 18:45:05 UTC
AV detection:
16 of 27 (59.26%)
Threat level:
  5/5
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:nanocore family:warzonerat family:xloader family:xmrig campaign:poni agilenet evasion infostealer keylogger loader miner persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/211108-xd26sshheq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
Warzone RAT Payload
Xloader Payload
Modifies WinLogon for persistence
NanoCore
WarzoneRat, AveMaria
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE Possible NanoCore C2 60B
xmrig
Malware Config
C2 Extraction:
darkworldblackerlocker.dumb1.com:5270
http://www.camimac.com/poni/
lockerrollercooller.mywire.org:54941
127.0.0.1:54941
Unpacked files
SH256 hash:
160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
MD5 hash:
08588477f0297262109025dcdf0a3237
SHA1 hash:
7ad57afccfcd18966c077e68fa3934ee1d9393ed
Link:
https://www.unpac.me/results/cb096f8a-e706-4bd7-96ae-f1714873ae30/
Malware family:
Warzone
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/160ea3850bd5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/203353/
  
URLhaus
https://urlhaus.abuse.ch/url/1766377/

Comments


Avatar
zbet commented on 2021-11-08 18:44:10 UTC

url : hxxp://198.46.132.212/1118/vbc.exe