MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40c4346a171db5d06a7e6002ff7307b559403662fc749c0f1de4d246f29dd411. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40c4346a171db5d06a7e6002ff7307b559403662fc749c0f1de4d246f29dd411
SHA3-384 hash: 3bac35b168bf063eb55bfa55be241366781ac48dd3702414b2eb3f44f5911be3c89dc780619ec1911aded6388ec54366
SHA1 hash: 830f862302eb7cd728807169f55737fc8d65c4b0
MD5 hash: 04fd333e92e941b5341ac41d1294b257
humanhash: quebec-fix-green-sink
File name:Vessel Specs_ Port Call.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:438'784 bytes
First seen:2022-06-25 08:31:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:QE4jtyFtLmt6m3FcBrRZt3oGS63/LSKcoGlHLTcVMK:rWyFdJtBrHZHSfvlHL8MK
Threatray 13'172 similar samples on MalwareBazaar
TLSH T101943B2C7B061A76FF1F817049510A08BBE72F237280A99357EB19CA874F4677F05D9A
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c9d4c4cda6a8cec6 (5 x Gh0stRAT, 2 x Formbook, 2 x FatalRAT)
Reporter Anonymous
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
210
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/283220/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Launching a process
Running batch commands
Creating a file
Creating a file in the %AppData% subdirectories
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62b6c7e51fcdba4e1a55e8c8/reports/5674a7b1-fd51-427a-a7c5-077a27a4baf2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d9ee9f8-da5b-46a4-9457-2b3927955f1e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1019690
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Binary or sample is protected by dotNetProtector
C2 URLs / IPs found in malware configuration
Drops PE files with benign system names
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Schedule system process
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 652186 Sample: Vessel Specs_ Port Call.exe Startdate: 25/06/2022 Architecture: WINDOWS Score: 100 50 www.heatedaffaisr.com 2->50 64 Multi AV Scanner detection for domain / URL 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 Antivirus detection for URL or domain 2->68 70 6 other signatures 2->70 11 Vessel Specs_ Port Call.exe 2 2->11         started        15 svchost.exe 2->15         started        signatures3 process4 file5 48 C:\Users\...\Vessel Specs_ Port Call.exe.log, ASCII 11->48 dropped 78 Writes to foreign memory regions 11->78 80 Allocates memory in foreign processes 11->80 82 Injects a PE file into a foreign processes 11->82 17 vbc.exe 11->17         started        20 cmd.exe 1 11->20         started        22 cmd.exe 3 11->22         started        84 Multi AV Scanner detection for dropped file 15->84 86 Machine Learning detection for dropped file 15->86 25 vbc.exe 15->25         started        27 cmd.exe 15->27         started        signatures6 process7 file8 52 Modifies the context of a thread in another process (thread injection) 17->52 54 Maps a DLL or memory area into another process 17->54 56 Sample uses process hollowing technique 17->56 62 2 other signatures 17->62 29 explorer.exe 17->29 injected 58 Uses schtasks.exe or at.exe to add and modify task schedules 20->58 60 Drops PE files with benign system names 20->60 31 conhost.exe 20->31         started        33 schtasks.exe 1 20->33         started        44 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32 22->44 dropped 46 C:\Users\user\...\svchost.exe:Zone.Identifier, ASCII 22->46 dropped 35 conhost.exe 22->35         started        signatures9 process10 process11 37 msdt.exe 29->37         started        signatures12 72 Modifies the context of a thread in another process (thread injection) 37->72 74 Maps a DLL or memory area into another process 37->74 76 Tries to detect virtualization through RDTSC time measurements 37->76 40 cmd.exe 1 37->40         started        process13 process14 42 conhost.exe 40->42         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/40c4346a171db5d06a7e6002ff7307b559403662fc749c0f1de4d246f29dd411/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-15 17:17:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
78
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=idcdi2qxdw25a2t6mabp64yhwvmuantc7r2jydy54tjen4u52qiq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
4fe26ebfc5412205231040de3bf8f865da141f2c9c5c2c809e4bf6ceced43e55
Formbook
6b80459293e1eae78fa4efafbc8ddae1fb2bdb73c35c0b1880fdb65d80a49114
Formbook
774d7c77607bc7964f40cbe18a7d63c76524fe5af7f6ad09a68fead4c35e9cdb
Formbook
ce7d3bdad0d089583e735635f3d475e11dde86d0ad1c76d8735085a9ec031d96
Formbook
de4f5d7be84c3a10afa75bd2463a7c2958afc54300f88962f8e069d121752796
Formbook
df1510f64189b49ffeb4630c74af81a86888114102b493f52b5ad1c1cb58d121
Formbook
df1b0eef4f32a5c2527691175375962957db71bc913d37f6e71150e599b2b31c
Formbook
e913d576e64c61f0fd94309e27a65a91f3418aae1914106ad0abc21745098428
Formbook
+ 13'162 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader campaign:9q2j loader persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220625-ke97ksfdc8/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Adds policy Run key to start application
Executes dropped EXE
Xloader Payload
Formbook
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Unpacked files
SH256 hash:
8e7e7cfaa5d71bcd8b20f40096ac7a600fdd9cfb826896aadd544dc0a70d931b
MD5 hash:
a30747788734b7b30ec768eca6625bba
SHA1 hash:
d07bf94c72594e64593fdb696ea547ff20481cb5
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
XLoader
Create hunting rule
Link:
https://www.unpac.me/results/ccc2b8ad-dea0-4ad8-808b-263dc64a03ef/
Parent samples :
9cbf58842ab2082dfb22e1f53939cd2d1dd66b551a4d9ec397ae558f35e5475f
40c4346a171db5d06a7e6002ff7307b559403662fc749c0f1de4d246f29dd411
b20ad6c8dd8844751924260b1fdf4527d6ca6629d8df09140733e88a7eae9db7
67af71fb0f05689aeca3a7ad228178ba5b1e5cf99a8b6f830c3c3f79ec1d056a
f2f1807e10def6ed679f26782bf880eb6246fcebb71e51bde767835cb1e1a5ed
SH256 hash:
40c4346a171db5d06a7e6002ff7307b559403662fc749c0f1de4d246f29dd411
MD5 hash:
04fd333e92e941b5341ac41d1294b257
SHA1 hash:
830f862302eb7cd728807169f55737fc8d65c4b0
Link:
https://www.unpac.me/results/ccc2b8ad-dea0-4ad8-808b-263dc64a03ef/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/40c4346a171d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40c4346a171db5d06a7e6002ff7307b559403662fc749c0f1de4d246f29dd411

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Babel
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Babel
Rule name:INDICATOR_EXE_Packed_Dotfuscator
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Dotfuscator
Rule name:INDICATOR_EXE_Packed_dotNetProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with dotNetProtector
Rule name:INDICATOR_EXE_Packed_Goliath
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Goliath
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/283220/

Comments