MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f277a6819833eb0c7feab4e952301b4bac883e38ec8bd266093b6757d1920e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f277a6819833eb0c7feab4e952301b4bac883e38ec8bd266093b6757d1920e8
SHA3-384 hash: 2bec55b611746e61ba19191e3c369a8f693203ecd3c206c281e43ddd069a2cebe2d57e07f01b3a53a629e4e5742912b9
SHA1 hash: 060c70157ceea0b08243a53e4baae2331b4449f8
MD5 hash: 5dde426d4383be37f818ee1205c50e11
humanhash: california-three-south-nineteen
File name:enquiry no. 2770034921.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:390'656 bytes
First seen:2022-01-27 14:40:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:iqBwO+Q45IX8LhyTaVMnKzlXL2L5d6AJ0moK2mXKydgqqk3+WyHzyG:ZIv1iyPC2mXQqqkudz
Threatray 12'924 similar samples on MalwareBazaar
TLSH T1FA84F13861979299F00F8EF122BCFA610272319328C95E790B5E6109DBEDF552F85E4F
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
enquiry no. 2770034921.exe
Verdict:
Malicious activity
Analysis date:
2022-01-27 22:33:28 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/23749042-ef5b-42d7-bb8b-18b2ce1bc18a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/224396/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Creating a process from a recently created file
Creating a file
Сreating synchronization primitives
Searching for synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61f2af0e20a5f4d327d4263c/reports/82869afa-460e-4b27-842e-65b41eabb532/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/05bfd8f3-508b-44c6-86f8-5863cb70add8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/929055
Behaviour
Behavior Graph:
n/a
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3f277a6819833eb0c7feab4e952301b4bac883e38ec8bd266093b6757d1920e8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-27 01:39:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h4txu2azqm7lbr76vnhjkiybws5mra7dr3el2jtaso3hk7izedua._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0450f9017a4e7556c6bbfa5e69363ed935e11fa47efff5755b172103b3b59892
Formbook
07bed83b3f7c13154a148f82ceac3fe9f68a7995ed5a939e91427e611bfaa863
Formbook
10ff5c8bac827b012bc5b6f789e7c23913b662453cd0bcc7f3f5192260d7a950
Formbook
194eecb866b404241cc14abfccf3ece512927dafff1e64248e1b1fb4e4acbd26
Formbook
32fea88907cbefd31749cedfc8b85d3775fca2f65b15594dde355624b3ad7cc8
Formbook
502303edd5a9de57b3667146e84f15fc4957242ca2ef8f75f5e503946c452ee2
Formbook
58fb47124bf49f4190852baec863af03f73216cbba65c7eaa527f6ec6612e42b
Formbook
81dc0dc902eb39bef1ff536e63644fac0d6aa928a200718185aaa21c137c7458
Formbook
d36d73e78b048c34b8ed4b2c1035f27c0c1857ae8eb5f1167942981139138b35
Formbook
d89ceaf1e34dd42cef063ecb6b8e219479f276c6cc30e2ab6ae8c881a8d60633
Formbook
+ 12'914 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:gab7 loader rat
Link:
https://tria.ge/reports/220127-r127esegg8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Xloader
Unpacked files
SH256 hash:
15c200196e9af13c1ebdd9483440bf0900607002a0b64b66b0e917c06556964e
MD5 hash:
b976c95e8ec96253b2c48e4a34c6dac7
SHA1 hash:
2a21ff1adccd95ec4c44b753d1200febca892873
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/4a417254-0e3b-4556-8cc6-b6e5860b3ebf/
Parent samples :
194eecb866b404241cc14abfccf3ece512927dafff1e64248e1b1fb4e4acbd26
3f277a6819833eb0c7feab4e952301b4bac883e38ec8bd266093b6757d1920e8
d3711d873d5b39de6ddd958a2418f6823b21808678797a397dc0495e5c419db1
SH256 hash:
f01bc420bd77f431f67f99d18eba81cf843c04fa3a36340db501eb8ae9aa0f4d
MD5 hash:
0bba5af6d15d31a59c0a591cf489d9ae
SHA1 hash:
8ab94f764a71256b965e836cbace297adc465f25
Link:
https://www.unpac.me/results/4a417254-0e3b-4556-8cc6-b6e5860b3ebf/
SH256 hash:
5247926388ed51a1178cb1de85bc5df1443c240ace43d7d9386edf8d7fceec02
MD5 hash:
9a6cb543f17cc6f61c016dbc8a331bc2
SHA1 hash:
62210e9d0f4d5b8101886a336feb3e1ae0eaf824
Link:
https://www.unpac.me/results/4a417254-0e3b-4556-8cc6-b6e5860b3ebf/
SH256 hash:
3f277a6819833eb0c7feab4e952301b4bac883e38ec8bd266093b6757d1920e8
MD5 hash:
5dde426d4383be37f818ee1205c50e11
SHA1 hash:
060c70157ceea0b08243a53e4baae2331b4449f8
Link:
https://www.unpac.me/results/4a417254-0e3b-4556-8cc6-b6e5860b3ebf/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3f277a681983/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/3f277a6819833eb0c7feab4e952301b4bac883e38ec8bd266093b6757d1920e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/224396/

Comments