MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e5709f12673cffcf4d3f5109303de822626c3a2a608f9c78a853c0c6d58edd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	2e5709f12673cffcf4d3f5109303de822626c3a2a608f9c78a853c0c6d58edd1
SHA3-384 hash:	a18a9c1b8250cf5cca5caa8ca864313da7c745bb59d766f4c28f04bdbd87336a3675319281f768375cee1ece87c7e7bc
SHA1 hash:	88fa2d701e2bcedaa43660af0bb12fa3053414da
MD5 hash:	eaff083cf662029659ef37118e198006
humanhash:	uniform-autumn-washington-early
File name:	SecuriteInfo.com.PWS-FCZIEAFF083CF662.3903.29659
Download:	download sample
Signature	Formbook Create hunting rule
File size:	756'736 bytes
First seen:	2021-06-02 09:01:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:WCyqvT8Du6WnPGA7B3Q7xkvjvwUFz/ST/LsT6935xA/50IMS7staJs9vedee:W310nTB2CjwUFzcLsT6HxxIi9Wc
Threatray	5'714 similar samples on MalwareBazaar
TLSH	47F46CF8F598A8F1C54ECB72C7959CAEEB2211FE5643092C02B9DA8C1B0379E9F5D444
Reporter	SecuriteInfoCom
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.PWS-FCZIEAFF083CF662.3903.29659

Verdict:

Suspicious activity

Analysis date:

2021-06-02 09:05:50 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c3b66969-683e-49f1-abd9-6e43e1ba67f7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/163973/

Detection(s):

SecuriteInfo.com.PWS-FCZIEAFF083CF662.3903.29659.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/795740

Signature

.NET source code contains method to dynamically call methods (often used by packers)

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/2e5709f12673cffcf4d3f5109303de822626c3a2a608f9c78a853c0c6d58edd1/

Threat name:

Win32.Trojan.Pwsx

Status:

Malicious

First seen:

2021-06-02 04:41:07 UTC

AV detection:

9 of 47 (19.15%)

Threat level:

5/5

Verdict:

malicious

Label(s):

formbook

Formbook

719604b516f11740266b2c7a8a61129f779caf4c1f9e16bac35d39f5792a009b

Formbook

780555ffbda34b2fe63790a38a7c3e4df0b437d17c22fe7c886fcd2ee72684d0

Formbook

7c8eea0e649a176edb83fc19998f0e99be49c7bee1ff9090d1be69f614554088

Formbook

8fb2a899e6622a2ddc7989121174bea2b7756f3f56f64f42dc6ef875d19ce919

Formbook

9f320c52479e05b96faa714826a7671787abf4c4eb33f8aa415b66d1551996ce

Formbook

b4881cc38748284029b7008aaf75c0f1f85a4dcb70a61425e787325736c83f36

Formbook

b736f06a6b82ce1a53ccf2f50cf4d73c24c00750778bebe152dcf3c1956671f9

Formbook

e1339c4548f73e4f250fed46d56bbce84491ca122aed7527731bb8d72df83e11

Formbook

e9a4a4d52dd0fa4d9536ef486a5a9e2213ca76c0edeb7be6a118e9c65571d37a

Formbook

+ 5'704 additional samples on MalwareBazaar

Result

Malware family:

xloader

Score:

10/10

Tags:

family:xloader loader rat

Link:

https://tria.ge/reports/210602-8p1hajlale/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Xloader Payload

Xloader

Malware Config

C2 Extraction:

http://www.adultpeace.com/p2io/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2e5709f12673cffcf4d3f5109303de822626c3a2a608f9c78a853c0c6d58edd1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.