MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e368a4169d8a0264fc83bb864b78e12e9a1784f99bc2f89c8619b8a0e3fd46b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e368a4169d8a0264fc83bb864b78e12e9a1784f99bc2f89c8619b8a0e3fd46b
SHA3-384 hash: 0d24c637ffa07ef7a17a27c840d49067a9571f01085666af46bddc1d0497d97a71315cf61a6ae6e5c25beed4ce9a66ad
SHA1 hash: c7ef15f0c0f4d312987334e011b158db94996f45
MD5 hash: 145643726a52eb059ff7f943bb2b005c
humanhash: two-football-yankee-early
File name:RTL_0075106330785202.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:630'272 bytes
First seen:2021-09-01 14:04:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:KG2+vNx53dGOdKCxWYcnXM4a5w98ZdHIac6CnFfm:z7vNxmOdKucn84gN2nB
Threatray 8'867 similar samples on MalwareBazaar
TLSH T197D48DB368BE1C04E6560EF44195B330D1752D5A3ACE9CC3D98CBA1ED0337E6B09A56B
dhash icon b032cc442c8cd290 (6 x a310Logger, 2 x Formbook, 1 x RemcosRAT)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RTL_0075106330785202.exe
Verdict:
Malicious activity
Analysis date:
2021-09-01 14:14:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3bc13d03-1f83-4521-bbcf-acd90241c696

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/184483/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46907560.25663.30374.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
DNS request
Using the Windows Management Instrumentation requests
Sending a UDP request
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0d6cffca-9dad-4d32-9f5a-7e800ef9c359
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/843386
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 475817 Sample: RTL_0075106330785202.exe Startdate: 01/09/2021 Architecture: WINDOWS Score: 100 40 time.google.com 2->40 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for dropped file 2->58 60 5 other signatures 2->60 11 RTL_0075106330785202.exe 1 9 2->11         started        signatures3 process4 file5 32 C:\Users\user\AppData\Roaming\...\chr.exe, PE32 11->32 dropped 34 C:\Users\user\...\RTL_0075106330785202.exe, PE32 11->34 dropped 36 C:\Users\user\...\chr.exe:Zone.Identifier, ASCII 11->36 dropped 38 2 other malicious files 11->38 dropped 62 Writes to foreign memory regions 11->62 64 Injects a PE file into a foreign processes 11->64 15 RTL_0075106330785202.exe 11->15         started        18 powershell.exe 19 11->18         started        signatures6 process7 dnsIp8 66 Multi AV Scanner detection for dropped file 15->66 68 Machine Learning detection for dropped file 15->68 70 Modifies the context of a thread in another process (thread injection) 15->70 72 3 other signatures 15->72 21 explorer.exe 3 3 15->21 injected 42 8.8.8.8.in-addr.arpa 18->42 44 4.4.8.8.in-addr.arpa 18->44 46 3 other IPs or domains 18->46 23 conhost.exe 18->23         started        signatures9 process10 process11 25 chr.exe 3 21->25         started        process12 27 powershell.exe 16 25->27         started        dnsIp13 48 8.8.8.8.in-addr.arpa 27->48 50 4.4.8.8.in-addr.arpa 27->50 52 2 other IPs or domains 27->52 30 conhost.exe 27->30         started        process14
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2e368a4169d8a0264fc83bb864b78e12e9a1784f99bc2f89c8619b8a0e3fd46b/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-09-01 05:48:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
14 of 28 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fy3iuqlj3cqcmt6iho4gjn4oclu2c6cptg6c7coimgnyudr72rvq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2ab54e46be8e8a1b7e66be9bed5492e2cb5c4112e548442e209954affc2dc374
Formbook
43368f8d0f777c8f0a9fb5dc2ec89f131275873935098ff8a12be41cd2161ecf
Formbook
8b4049ea3937e355ad9a551795afcb621fb56991ffc6f1db746861acfd7d6a46
Formbook
93f0775c5a5512759f85db7b3d1c4b3ee7049369cd0dcd1d4f778626621bfa0c
Formbook
a7c09392aa26962b20d2fc58398b6425ebd062187b2923fbbb7b1866523f1e26
Formbook
b09fdc39338aacafb7eb0163757d2b9863f78e5467af017ff4ad2f09e0e266a2
Formbook
d6fa87fb59dbf4de1d1d0af1062a41e6a9620b682ecdfc0eb91856e28b9ea1de
Formbook
+ 8'857 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:wdhc loader persistence rat suricata
Link:
https://tria.ge/reports/210901-yacrqmshls/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.webtinchap.com/wdhc/
Unpacked files
SH256 hash:
e3cb19eeb473e44b9f4a012a074a34d6559618bc1a1ad74b31d61ec26f7aa30c
MD5 hash:
f96eaf4df251ad126407a019d034d758
SHA1 hash:
228170a29a5c453ce249b03efccf8eb80f490975
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/d7b979c2-e12d-4c30-8522-b2409b0663f6/
Parent samples :
2e368a4169d8a0264fc83bb864b78e12e9a1784f99bc2f89c8619b8a0e3fd46b
fc24f060e9ffd04558497c27d9694182ab650ef2f985e29017ea63a7b7d3d5a6
SH256 hash:
ea3273d561542684f481a491d3540ca1267a3694aa7baa8ce908df5a44315cb7
MD5 hash:
cde5c43dd146a80414139354a7253375
SHA1 hash:
ec6ff3df6f6b05a13b27662e5327b839e2270f38
Link:
https://www.unpac.me/results/d7b979c2-e12d-4c30-8522-b2409b0663f6/
SH256 hash:
47664a30a8a9b52fb749a094efa59b2e5e333df6e10318d104dd6e884f4922ed
MD5 hash:
de619771a3fa08359f0879a18d8fc89d
SHA1 hash:
ab1ca63d580654b726f8847b355dfe4c9996b90a
Link:
https://www.unpac.me/results/d7b979c2-e12d-4c30-8522-b2409b0663f6/
SH256 hash:
2e368a4169d8a0264fc83bb864b78e12e9a1784f99bc2f89c8619b8a0e3fd46b
MD5 hash:
145643726a52eb059ff7f943bb2b005c
SHA1 hash:
c7ef15f0c0f4d312987334e011b158db94996f45
Link:
https://www.unpac.me/results/d7b979c2-e12d-4c30-8522-b2409b0663f6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e368a4169d8a0264fc83bb864b78e12e9a1784f99bc2f89c8619b8a0e3fd46b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/184483/

Comments