MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3b612f10d1f41e30c40ce875d094f2e78c8744d4b3647683fc6af2212da4e233. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 3b612f10d1f41e30c40ce875d094f2e78c8744d4b3647683fc6af2212da4e233 |
|---|---|
| SHA3-384 hash: | c33f81c56dab244318b26f3c614295feea6dff2b43c05abc7131213d3b4e000a7f04020252e7cee2c67549691ef5517a |
| SHA1 hash: | d7db4332d9815e1645c89594666bb133eb881f4b |
| MD5 hash: | 2dff0088cd70e51e064c7e7393e53ddf |
| humanhash: | jupiter-alpha-river-butter |
| File name: | scab_document087654321234567.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 234'286 bytes |
| First seen: | 2021-08-06 13:45:52 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0c517b095db8f3da579eca576ece2d27 (4 x Loki, 3 x Formbook, 1 x AgentTesla) |
| ssdeep | 6144:SHa7kigAgZKA1xG7plOkMdpHnJCp4XStzADm2nTp:v7xgN0SxG7fNMrHM4XS4m2nTp |
| Threatray | 7'476 similar samples on MalwareBazaar |
| TLSH | T1F334121FA0231B31E02558749BD165F9485D0AB2CBD219E4DD42B5BEE272B309BF8F27 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
400
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
scab_document087654321234567.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-06 13:53:47 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Unauthorized injection to a recently created process
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Signature
Detected unpacking (changes PE section rights)
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Detection:
xloader
Threat name:
Win32.Trojan.Fugrafa
Status:
Malicious
First seen:
2021-08-06 06:03:29 UTC
AV detection:
20 of 46 (43.48%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 7'466 additional samples on MalwareBazaar
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:nt83 loader rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.bnmud.com/nt83/
Unpacked files
SH256 hash:
b4f8fb64a26d5cc53d5679664d8eee30ca750514f8f3df9e5638a6c28d9fe8d6
MD5 hash:
6df3febe6011c2890b6596efbbc3de0b
SHA1 hash:
9a104ed3f498f5f520a0144e2e50536b167aa59c
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
3b612f10d1f41e30c40ce875d094f2e78c8744d4b3647683fc6af2212da4e233
MD5 hash:
2dff0088cd70e51e064c7e7393e53ddf
SHA1 hash:
d7db4332d9815e1645c89594666bb133eb881f4b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.13
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.