MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a0bfa39b87cbf226d56a6195270ebf86641b92d4fa2af8b7636f68f807e502f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a0bfa39b87cbf226d56a6195270ebf86641b92d4fa2af8b7636f68f807e502f
SHA3-384 hash: 336bf075f7a21b440a09cc379a5a64c445b0b99dfc589826bbc270aa43e00758c76f1689a63cd021c06fecdd468f8075
SHA1 hash: b04e1d2373d1b7ef1965d6a1a89863370953bf4d
MD5 hash: 0056065ea15704e520cb3a622f21c666
humanhash: tennessee-quebec-lion-red
File name:SecuriteInfo.com.Variant.Lazy.168110.7896.15430
Download: download sample
Signature Formbook
Create hunting rule
File size:1'095'168 bytes
First seen:2022-04-14 10:33:57 UTC
Last seen:2022-04-20 10:24:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'813 x AgentTesla, 19'735 x Formbook, 12'282 x SnakeKeylogger)
ssdeep 24576:N2+rGw4HRnJnmGxnDDTFyL7+fwmAsuz7BN:Q+rGwqpJjBFyLqfDAJJ
Threatray 12'097 similar samples on MalwareBazaar
TLSH T1ED357C0213E81D5BE1FF6BB45936550483F6B90BAA76D39E6C8464DE1DA1F028F23723
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Lazy.168110.7896.15430
Verdict:
Suspicious activity
Analysis date:
2022-04-14 10:37:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/200aea44-231c-46c2-b037-937fd797756e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/263653/
Detection(s):
SecuriteInfo.com.Variant.Lazy.168110.7896.15430.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/6257f8adffe27d5119cd1816/reports/545db7e4-1178-499d-bc51-58e3cabc064d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d4cd525-cc41-43e6-9fd3-79496c477270
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/976731
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4a0bfa39b87cbf226d56a6195270ebf86641b92d4fa2af8b7636f68f807e502f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-14 10:36:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
49
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jif7uonyps7se3kwuymve4hl7btedojnj6rk7c3wg33i7ad6kaxq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
04b751d8d2bee0880babadcee34e68f6333e4b0a636c7321e06361da1618cff1
Formbook
2eaed26372d31a289db21c2dc6f82a9b6c3742e1c072bd7eab68c1774e2e847d
Formbook
3c24b4fa538ae960f1c4148093d4ada972aeddc97366a42fc75c465d70dba293
Formbook
65ae1f1e2a2f90253d2e2a241514f2dfc3b5570f2ecf3df750281dca01879c7e
Formbook
6b55967f7016ed23e103ee4618651616d93bb9674497f910dd0cb26d6ebab7bc
Formbook
78f50e9fa31c343998c5fde9e692d83c73e478650550c1c830247a1253fda278
Formbook
7bcbf56053c133b1e92640bbd6ba32fc7bfcb202e4e0867b67518a75293c5d03
Formbook
abf6e4dbdc36900f0f2be2111c9431704d2e770a92eba6bf9210cd39e18f5139
Formbook
+ 12'087 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:rm3m loader rat
Link:
https://tria.ge/reports/220414-ml4pgsbab8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
4a0bfa39b87cbf226d56a6195270ebf86641b92d4fa2af8b7636f68f807e502f
MD5 hash:
0056065ea15704e520cb3a622f21c666
SHA1 hash:
b04e1d2373d1b7ef1965d6a1a89863370953bf4d
Link:
https://www.unpac.me/results/50ea01e1-c6f1-4b6e-8117-04a67ef8d8a1/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4a0bfa39b87c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a0bfa39b87cbf226d56a6195270ebf86641b92d4fa2af8b7636f68f807e502f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263653/

Comments