MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c0d3399664b5cde939a235ecd72cf708c48e8c7994eb2973b0d235aa475fbc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c0d3399664b5cde939a235ecd72cf708c48e8c7994eb2973b0d235aa475fbc7
SHA3-384 hash: 75a231a04fd32b51e516d49bd9571c4d3cab60c6afdd70806b2c0954adf1c462becb0e63082b9c847c93c8a2fb240b8f
SHA1 hash: 97cfa25e20614f8768ce425df62d7cbadf6eaa8d
MD5 hash: f0f480fd13db3abe7b44c0fd618eb1cc
humanhash: ceiling-lactose-bluebird-ohio
File name:hcQl7ELtyrJ9kB1.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:630'272 bytes
First seen:2022-06-02 11:08:00 UTC
Last seen:2022-06-02 11:48:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:7RAaAalPGEj4ngpWcXh4GUHVevFvZLtcyAMYh102H:7GHaMngpW0i31aIzH
Threatray 15'951 similar samples on MalwareBazaar
TLSH T17BD4F1D1D327EE7AF51871737224905C2750152DD5D0DA3ADAACB18E30A134B29FAF8B
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
309
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
hcQl7ELtyrJ9kB1.exe
Verdict:
Malicious activity
Analysis date:
2022-06-02 11:09:36 UTC
Tags:
formbook trojan stealer
Link:
https://app.any.run/tasks/f974c608-48ac-4865-aeab-eeb1b744371e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/276306/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1364.24307.8005.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62989a4f0003c05e7e9505b4/reports/9fe74e79-4042-44f9-bfcc-2a5ebd538240/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b1cc99d-56a7-4dad-aaa2-2ea8f7147819
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1005659
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd or bat file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 638154 Sample: hcQl7ELtyrJ9kB1.exe Startdate: 02/06/2022 Architecture: WINDOWS Score: 100 33 www.windowcleaningsbra.com 2->33 35 www.denel-es.com 2->35 43 Snort IDS alert for network traffic 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 6 other signatures 2->49 11 hcQl7ELtyrJ9kB1.exe 3 2->11         started        signatures3 process4 file5 31 C:\Users\user\...\hcQl7ELtyrJ9kB1.exe.log, ASCII 11->31 dropped 61 Tries to detect virtualization through RDTSC time measurements 11->61 15 hcQl7ELtyrJ9kB1.exe 11->15         started        18 hcQl7ELtyrJ9kB1.exe 11->18         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 20 explorer.exe 15->20 injected process9 dnsIp10 37 www.gemarellla.com 199.34.228.173, 49774, 80 WEEBLYUS United States 20->37 39 entrecompadres.com 156.67.79.150, 49769, 80 TESONETLT United States 20->39 41 7 other IPs or domains 20->41 51 System process connects to network (likely due to code injection or exploit) 20->51 24 mstsc.exe 20->24         started        signatures11 process12 signatures13 53 Self deletion via cmd or bat file 24->53 55 Modifies the context of a thread in another process (thread injection) 24->55 57 Maps a DLL or memory area into another process 24->57 59 Tries to detect virtualization through RDTSC time measurements 24->59 27 cmd.exe 1 24->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2c0d3399664b5cde939a235ecd72cf708c48e8c7994eb2973b0d235aa475fbc7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-02 09:02:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
23 of 41 (56.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fqgthglgjnon5e42enpm24wpocger2ghtfhlffz3burvvjdv7pdq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
19f5a2d97c62b9c69a31e8cd0dddc9e18c852158bc1dc00a664bace1cbe7c2a0
Formbook
1cd33724c01b65b8d262ba93e03a496927476307c7f69ca092eb930ab5c2d0c4
Formbook
49b5b36041408c4f58810bad116898bec932533a1487099f1049c0df3740688f
Formbook
5bfe4d5a08d4f16b9f65aac8e22e639a9e0a47a82ef6217727fe0d8581a84614
Formbook
613b5446494dbc42b570d8435ab8fd6d85a1b58a86235da24381b6cb74ec6fd9
Formbook
74520a3fdf8105f8650110816d310fde0f8abe7dae410b8c73fd9aaae5acfd3c
Formbook
a22ca7acaf7bfae77ff56f08b010ac618fb6ed2d6faddfc593b6f552c0e86f5b
Formbook
b138102457454a3101f17bba4da29d991c4330f387df3d0db2165aaabee608d2
Formbook
b8f4718e9a80ba3c3e7bef050922a84bb4632557d46e05cc2b46d0e175f1ef95
Formbook
+ 15'941 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:usps loader persistence rat spyware stealer suricata
Link:
https://tria.ge/reports/220602-m8jylafdd9/
Behaviour
Gathers network information
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Reads user/profile data of web browsers
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
cff04f25330da07fa60a88720273f3806dbbaf107ec634adbd9a26fec5adda68
MD5 hash:
51bce2cd04f98ceb38fcb4d3be5b05c1
SHA1 hash:
21ce391350d5e925252049c0e04c95252910bfb6
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/31d68b62-5f9f-4fc6-80bc-88bb3a012414/
Parent samples :
a22ca7acaf7bfae77ff56f08b010ac618fb6ed2d6faddfc593b6f552c0e86f5b
3ab5efb42def342934ed461b4247037bb89eb0bb25fe12d33ac79f448aaf9eb7
2c0d3399664b5cde939a235ecd72cf708c48e8c7994eb2973b0d235aa475fbc7
5fe21adc879b7c46be96deb69eb55316d0f4834a039e151f77f8cd37974b798c
SH256 hash:
0d7bd7b732cc8c5126346c66f8254a4c9b9359aaeb74da6865cbbe0f76429dd6
MD5 hash:
367a9472f31eb77e1eee18ee1f9f7971
SHA1 hash:
80acd1ec34cbde09ac6316390fce7518e5c70a23
Link:
https://www.unpac.me/results/31d68b62-5f9f-4fc6-80bc-88bb3a012414/
SH256 hash:
0a3471269e2d144c73d3fecef12c6cad02607f2fa3d14f463e54200b99c39ab6
MD5 hash:
8a901365c6d98b2282989ac689b8b95f
SHA1 hash:
76405b6c8027dd5cc5ceb9174c8ec475da396318
Link:
https://www.unpac.me/results/31d68b62-5f9f-4fc6-80bc-88bb3a012414/
SH256 hash:
879c29560b21be7d9b69ca27ca4756df86e080fa3e34cb191aad5cb1e5f05504
MD5 hash:
30b6a54a992eae921a2eb8c5ea130911
SHA1 hash:
1c83f0319bffe007077c6656418c9b7344d5affe
Link:
https://www.unpac.me/results/31d68b62-5f9f-4fc6-80bc-88bb3a012414/
SH256 hash:
2c0d3399664b5cde939a235ecd72cf708c48e8c7994eb2973b0d235aa475fbc7
MD5 hash:
f0f480fd13db3abe7b44c0fd618eb1cc
SHA1 hash:
97cfa25e20614f8768ce425df62d7cbadf6eaa8d
Link:
https://www.unpac.me/results/31d68b62-5f9f-4fc6-80bc-88bb3a012414/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2c0d3399664b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/2c0d3399664b5cde939a235ecd72cf708c48e8c7994eb2973b0d235aa475fbc7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 2c0d3399664b5cde939a235ecd72cf708c48e8c7994eb2973b0d235aa475fbc7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/276306/

Comments