MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4aaadbc01cbdf6c3cf232a04653c09f27c173e430651a9f4923c863bd6edd867. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	4aaadbc01cbdf6c3cf232a04653c09f27c173e430651a9f4923c863bd6edd867
SHA3-384 hash:	d43171704c1548d2cdfbc2f19b090552725d4ac22811d460005ae69b9e15961bebe16931ba054fe2f8b92b08a4d9ef76
SHA1 hash:	7234dd9c2be7ce5f585ec13c708ff235a9288f2c
MD5 hash:	8861e8d370a83f94c0606ac40ccf777e
humanhash:	kansas-hydrogen-burger-nebraska
File name:	DHLDOC.ace
Download:	download sample
Signature	Formbook Create hunting rule
File size:	376'838 bytes
First seen:	2022-01-13 06:55:49 UTC
Last seen:	Never
File type:	ace
MIME type:	application/octet-stream
ssdeep	6144:u2HYIiyd0GThLAPFX0RwFdJDM4NKen4IRIeKBfcpNseiBLVs0Uldpcj:u2HY8tTh0PFERAJD9NKen4QI9BfcpNs9
TLSH	T10C8423621670E42D1C3D1AAD3342DE4EA922536CC9B48095D4D4FD03186AEFEC7AF65F
Reporter	cocaman
Tags:	ace DHL FormBook

cocaman

Malicious email (T1566.001)
From: ""DHL EXPRESS" <admin@dhl.com>" (likely spoofed)
Received: "from hp0.dmbavxo.bar (unknown [147.182.255.218]) "
Date: "Thu, 13 Jan 2022 03:58:59 +0000"
Subject: "DHL EXPRESS SHIPMENT"
Attachment: "DHLDOC.ace"

Intelligence

File Origin

# of uploads :

# of downloads :

177

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/61dfcd071883c5ba4ec6ec50/reports/8e7f90d1-dfb2-46bf-b7e0-ddc0cffdcecc/overview

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4aaadbc01cbdf6c3cf232a04653c09f27c173e430651a9f4923c863bd6edd867/

Threat name:

ByteCode-MSIL.Backdoor.NanoBot

Status:

Malicious

First seen:

2022-01-13 06:56:10 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

13 of 28 (46.43%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jkvnxqa4xx3mhtzdficgkpaj6j6bopsdazi2t5eshsddxvxn3btq._file

Result

Malware family:

xloader

Score:

10/10

Tags:

family:xloader campaign:uite loader rat

Link:

https://tria.ge/reports/220113-hqcz4sgcc7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Xloader Payload

Xloader

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/4aaadbc01cbdf6c3cf232a04653c09f27c173e430651a9f4923c863bd6edd867

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ACE_Containing_EXE Create hunting rule
Author:	Florian Roth - based on Nick Hoffman' rule - Morphick Inc
Description:	Looks for ACE Archives containing an exe/scr file