MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ef3c48dcc895ea8fd3476f43a87ec6a3a38d648db26fa6a3e48d3042c2c081a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs 2 YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ef3c48dcc895ea8fd3476f43a87ec6a3a38d648db26fa6a3e48d3042c2c081a
SHA3-384 hash: 2ff8dfb73468e350bacbe7e3892ed041f083e0578b1910027046d0e886ef8ccec6d4d7ff48f32f45bf88bd3b7c89ebe4
SHA1 hash: f59928ba65b4a718cb05a40696f191db75c3b949
MD5 hash: 1b942194465c8ebe8db0f98539d3ea63
humanhash: coffee-kentucky-washington-princess
File name:2EF3C48DCC895EA8FD3476F43A87EC6A3A38D648DB26F.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:599'040 bytes
First seen:2021-10-28 10:42:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:XqnOdCPAgSUKqztklKbPuKUhF6WUpNbdOx9:X+OdGZkcbPuK2FUnd+
Threatray 91 similar samples on MalwareBazaar
TLSH T122D45C242AF96925F1BF9B78D5F068AA8B79B9537753EF0F049103850A23741DD80B3B
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Formbook C2:
http://62.109.1.30/triggers/vm_.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://62.109.1.30/katanazeromultiplayer/ExternalProcessorgenerator.php https://threatfox.abuse.ch/ioc/234884/
http://62.109.1.30/triggers/vm_.php https://threatfox.abuse.ch/ioc/239224/

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DCRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200894/
Detection(s):
Win.Packed.Uztuby-9853721-0
Create hunting rule

Win.Packed.Uztuby-9864800-0
Create hunting rule

Win.Packed.Uztuby-9869253-0
Create hunting rule

Win.Packed.Uztuby-9873584-0
Create hunting rule

Win.Packed.Basic-9876200-0
Create hunting rule

Win.Packed.Uztuby-9891175-0
Create hunting rule

Win.Packed.Uztuby-9901274-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.AsyncRAT.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Using the Windows Management Instrumentation requests
Launching a process
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm dcrat hacktool obfuscated packed stealer
Link:
https://www.filescan.io/uploads/617a7eba9a5a1e91c5d99d8c/reports/d3ec36f0-68f0-455b-8182-5cf375896a23/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dark Crystal RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/795a1a4e-3df5-4b63-bd21-1510873b3746
Result
Threat name:
DCRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/878495
Signature
.NET source code contains very large strings
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Creates processes via WMI
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DCRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510924 Sample: 2EF3C48DCC895EA8FD3476F43A8... Startdate: 28/10/2021 Architecture: WINDOWS Score: 100 49 Multi AV Scanner detection for domain / URL 2->49 51 Antivirus detection for dropped file 2->51 53 Antivirus / Scanner detection for submitted sample 2->53 55 10 other signatures 2->55 7 2EF3C48DCC895EA8FD3476F43A87EC6A3A38D648DB26F.exe 10 19 2->7         started        11 spoolsv.exe 3 2->11         started        13 cRdpAsFeLcgQsd.exe 2 2->13         started        16 13 other processes 2->16 process3 dnsIp4 29 C:\Windows\tracing\fontdrvhost.exe, PE32 7->29 dropped 31 C:\Windows\System32\...\spoolsv.exe, PE32 7->31 dropped 33 C:\Program Files (x86)\...\cRdpAsFeLcgQsd.exe, PE32 7->33 dropped 35 6 other malicious files 7->35 dropped 59 Detected unpacking (overwrites its own PE header) 7->59 61 Creates an undocumented autostart registry key 7->61 63 Creates multiple autostart registry keys 7->63 75 3 other signatures 7->75 18 cmd.exe 1 7->18         started        65 Antivirus detection for dropped file 11->65 67 Multi AV Scanner detection for dropped file 11->67 69 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->69 71 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->71 37 ip-api.com 13->37 39 ip-api.com 208.95.112.1, 49686, 49689, 49692 TUT-ASUS United States 13->39 41 ipinfo.io 34.117.59.81, 443, 49685, 49691 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 13->41 43 ipinfo.io 16->43 45 ipinfo.io 16->45 47 4 other IPs or domains 16->47 file5 73 May check the online IP address of the machine 45->73 signatures6 process7 signatures8 57 Drops executables to the windows directory (C:\Windows) and starts them 18->57 21 spoolsv.exe 2 18->21         started        23 w32tm.exe 1 18->23         started        25 conhost.exe 18->25         started        27 chcp.com 1 18->27         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ef3c48dcc895ea8fd3476f43a87ec6a3a38d648db26fa6a3e48d3042c2c081a/
Threat name:
ByteCode-MSIL.Backdoor.LightStone
Create hunting rule
Status:
Malicious
First seen:
2021-08-07 15:30:18 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f3z4jdomrfpkr7juo32dvb7mni5drvsi3mtpu2r6jdjqilbmbana._file
Verdict:
malicious
Similar samples:
36d1497c536921f332a26558c9eff42f6502bf5ffec6710f4b50e35f98e627aa
Formbook
6a0d05477e23fc1152067fc51d50a044bccf0e0a0654dbae1864df792400e935
Formbook
9550c84ed4f760fd806bca85f64f00f877d676eeae5a1982c4bf815dd7d29ee5
Formbook
aaa3cda8d3f4bc7ff94a3e4f0fd37aced9d484b663bc15f198e6e25482f60443
Formbook
b8c94207197749e607ab88f5ca8c7b3f8a7802fef556462607905fd3300157ec
Formbook
bdeb14ad6ce1ac8539d4b937c593ae706826fd3732ad506de5189521eea43643
Formbook
+ 81 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer persistence rat
Link:
https://tria.ge/reports/211028-mrq1kscbe9/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in System32 directory
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
DCRat Payload
DcRat
Modifies WinLogon for persistence
Process spawned unexpected child process
Unpacked files
SH256 hash:
2ef3c48dcc895ea8fd3476f43a87ec6a3a38d648db26fa6a3e48d3042c2c081a
MD5 hash:
1b942194465c8ebe8db0f98539d3ea63
SHA1 hash:
f59928ba65b4a718cb05a40696f191db75c3b949
Link:
https://www.unpac.me/results/9828c713-5462-461e-b68a-8f157793bd9a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ef3c48dcc895ea8fd3476f43a87ec6a3a38d648db26fa6a3e48d3042c2c081a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_DCRat
Create hunting rule
Author:ditekSHen
Description:DCRat payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/200894/

Comments