MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ce43811e2050c26ceb77421b8c2dba4f606bde9380baa6627d3c5512db7eca9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ce43811e2050c26ceb77421b8c2dba4f606bde9380baa6627d3c5512db7eca9
SHA3-384 hash: 5ce87cde4fba3d43b94d54b10aa16ea6570c4a42fda18c6d8349b7a86cb82bb134f82880fd992f76c403bc3b5a5ba49a
SHA1 hash: 0cf2807b16c2cbf7d9a47854aaccc2653eb4df5e
MD5 hash: 5d7a426f8569371c2bdfc6f005bfe951
humanhash: eighteen-cold-hawaii-salami
File name:5d7a426f8569371c2bdfc6f005bfe951
Download: download sample
Signature Formbook
Create hunting rule
File size:518'144 bytes
First seen:2021-09-01 15:30:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:xRSBGEdwPKHlkGcalfJf/ErvmYzzHfla7peW7PvdL:xRS0Ed5HS
Threatray 11'013 similar samples on MalwareBazaar
TLSH T173B4EF9D7250B1DFC52BCD76C9A42C64AA20B47B430BE243949325ECAE0D69BCF164F3
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
248
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ.doc
Verdict:
Malicious activity
Analysis date:
2021-09-01 15:13:44 UTC
Tags:
exploit CVE-2017-11882 loader trojan formbook stealer
Link:
https://app.any.run/tasks/f89fcb29-a6fa-478e-8985-5633a7a349d3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184510/
Detection(s):
SecuriteInfo.com.Suspicious.Win32.Save.a.26591.157.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b6a227b8-81c3-4e05-90e2-3b517788d7c4
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/843468
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 475902 Sample: 7i244MHx9e Startdate: 01/09/2021 Architecture: WINDOWS Score: 100 31 www.dheeclinical.com 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 6 other signatures 2->45 11 7i244MHx9e.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\7i244MHx9e.exe.log, ASCII 11->29 dropped 57 Tries to detect virtualization through RDTSC time measurements 11->57 59 Injects a PE file into a foreign processes 11->59 15 7i244MHx9e.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.alconcentralconstruction.com 18->33 35 www.nlp4now.com 154.210.135.229, 49711, 80 XIAOZHIYUN1-AS-APICIDCNETWORKUS Seychelles 18->35 37 8 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 mstsc.exe 18->22         started        signatures11 process12 signatures13 49 Self deletion via cmd delete 22->49 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3ce43811e2050c26ceb77421b8c2dba4f606bde9380baa6627d3c5512db7eca9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-01 15:31:07 UTC
AV detection:
23 of 43 (53.49%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
047ca53bf616a52ba6946c0a6cf6676a3030b0baf6d987b6268203caebd87b74
Formbook
2eb57ff3dfafc142e693dd878044f38cb02090cbef35246b2525d19abf0fbaf5
Formbook
647c043687621e012ac9c04a69fe8590198d8e8e369431723dc848436438939a
Formbook
88bbfc76950d7dcecb7e9c4fc85b2d4efae4be7f7b766e407917f1478944988c
Formbook
9ce9e41c146be2b9aecbed6e14d9c4fa9d69d6b51038ba27782d08a432c8c95d
Formbook
b1fbc6ceb27ff1142228b55cfc493da29609dcaf9660ce70af8e574beecfd560
Formbook
c58abe9cc2eda9f80841417a5e8dd7c75416cf0183a6fda6b616a2c312450ab5
Formbook
cf63b3171706b81798fce776753cb1f7b4f8ae736e56f232a505f8dde09e8a41
Formbook
eb2f60b27fe8568bceadd7535f5f7c88de028cf454185a54a4b0b2aa0be63a17
Formbook
+ 11'003 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:9t6k loader rat
Link:
https://tria.ge/reports/210901-tbc6vmvl3a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.schoolphysician.com/9t6k/
Unpacked files
SH256 hash:
db4778975593941c2f55cc96f976b3913f34fdb4271d72cb7d8724a7b9acaedc
MD5 hash:
e1c3d6d43675ba42af260fb9478bdca1
SHA1 hash:
e49b934aea6b5b2bd529757f1b865687ead248d4
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/1b0b795f-dc18-467c-bf11-407cd70e4a4b/
Parent samples :
88bbfc76950d7dcecb7e9c4fc85b2d4efae4be7f7b766e407917f1478944988c
3ce43811e2050c26ceb77421b8c2dba4f606bde9380baa6627d3c5512db7eca9
31a06c8d10ff489460190d4ff7a81d62be80348f6c47a99984a8defe3bb9e333
SH256 hash:
bf7915b8f8e31b3ac28caa9644859507d0b9d7fe38ce5f8e6d8f6a815b41e260
MD5 hash:
aaf1730a497db3fd098046af400cc232
SHA1 hash:
2851c4ee858932ca4353a191da2c3afa3521cdd9
Link:
https://www.unpac.me/results/1b0b795f-dc18-467c-bf11-407cd70e4a4b/
SH256 hash:
7b521a0506ee7e12a1416d1ea05351e97fcdeedaca9a92de69b0e7d1ae4b3f0f
MD5 hash:
43328cd53e21a482345ffe640fba903e
SHA1 hash:
21bfff13a20b1781adf1a6fc0c24809054f5f93e
Link:
https://www.unpac.me/results/1b0b795f-dc18-467c-bf11-407cd70e4a4b/
SH256 hash:
3ce43811e2050c26ceb77421b8c2dba4f606bde9380baa6627d3c5512db7eca9
MD5 hash:
5d7a426f8569371c2bdfc6f005bfe951
SHA1 hash:
0cf2807b16c2cbf7d9a47854aaccc2653eb4df5e
Link:
https://www.unpac.me/results/1b0b795f-dc18-467c-bf11-407cd70e4a4b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/3ce43811e2050c26ceb77421b8c2dba4f606bde9380baa6627d3c5512db7eca9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 3ce43811e2050c26ceb77421b8c2dba4f606bde9380baa6627d3c5512db7eca9

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1583600/
Cape
Cape
https://www.capesandbox.com/analysis/184510/

Comments


Avatar
zbet commented on 2021-09-01 15:30:14 UTC

url : hxxp://lg-tv.tk/odinakazx.exe