MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4adcae40731cb2729fc62542c0e6c48717d461fa0f203be15c0cfd39f8b4ffea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4adcae40731cb2729fc62542c0e6c48717d461fa0f203be15c0cfd39f8b4ffea
SHA3-384 hash: f72f9abd162a4d4959c15ed8030fa2bfee1438e64ecf8155f4207a5d336f8f0d07b0734ef9faae2f95788e96dd3d70ad
SHA1 hash: 1b7e4910be82696337d911096c0433b088e4d5ee
MD5 hash: eeab5d28902fb4aff988c480067be6c5
humanhash: sweet-hawaii-pasta-sodium
File name:Orde Approved #11024021#.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:384'000 bytes
First seen:2021-11-24 07:39:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'658 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 6144:PBlouWiaRfpsxNN8aIzdXMrbWJhZdspsIX4AnN5vOa8W2o:PDouWiyfpsxozzdcrSQXHnr2Ru
Threatray 11'655 similar samples on MalwareBazaar
TLSH T17084012132F5A357C8BA5BF40C2464C413B265553A16D32DADDC61CF2EB2F178B22AE7
Reporter GovCERT_CH
Tags:exe FormBook xloader

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Orde Approved #11024021#.exe
Verdict:
Malicious activity
Analysis date:
2021-11-24 07:42:19 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/b0b1cddf-44ee-4436-af95-d0d53e63034c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
formbook obfuscated packed
Link:
https://www.filescan.io/uploads/619dec56b71ceed4152e2a81/reports/bdfef4b6-1e64-47e8-8864-24162c48b96c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e38db0de-5e46-41e6-b16c-e2554ff0a3d5
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/895196
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 527674 Sample: Orde Approved #11024021#.exe Startdate: 24/11/2021 Architecture: WINDOWS Score: 100 36 www.bestpaparazzi.com 2->36 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 7 other signatures 2->46 11 Orde Approved #11024021#.exe 3 2->11         started        signatures3 process4 file5 28 C:\Users\...\Orde Approved #11024021#.exe.log, ASCII 11->28 dropped 14 Orde Approved #11024021#.exe 11->14         started        process6 signatures7 56 Modifies the context of a thread in another process (thread injection) 14->56 58 Maps a DLL or memory area into another process 14->58 60 Sample uses process hollowing technique 14->60 62 Queues an APC in another process (thread injection) 14->62 17 explorer.exe 14->17 injected process8 dnsIp9 30 www.theabsexpert.com 154.196.10.184, 49800, 80 SKHT-ASShenzhenKatherineHengTechnologyInformationCo Seychelles 17->30 32 elsalvadoresv.com 104.219.248.102, 49826, 80 NAMECHEAP-NETUS United States 17->32 34 9 other IPs or domains 17->34 38 System process connects to network (likely due to code injection or exploit) 17->38 21 systray.exe 17->21         started        signatures10 process11 signatures12 48 Self deletion via cmd delete 21->48 50 Modifies the context of a thread in another process (thread injection) 21->50 52 Maps a DLL or memory area into another process 21->52 54 Tries to detect virtualization through RDTSC time measurements 21->54 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4adcae40731cb2729fc62542c0e6c48717d461fa0f203be15c0cfd39f8b4ffea/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-11-24 05:18:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlok4qdtdszhfh6gevbmbzweq4l5iyp2b4qdxyk4bt6tt6fu77va._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
071ff0663683acd797626d877df6a388efed518c61ab3c083034c27841a6742e
Formbook
2c81bc76bb2b34fc085a6ff0beb19fda2b1e400ad67341f55185b8d8b7351643
Formbook
3046d29324f18d00e2603aa26674aa29e9cc9ff3e110fb51e23204ff06e36f70
Formbook
4f2852e38ccd6fa9cce1580220421fc57c80c4978ab11f54f94927974e5ae2a5
Formbook
7b11c921e5383232009985b5912967978ae269287359f9c1718c2b37e1a067f8
Formbook
894f9fa39a5922cc3ec8d79c7957cfacbb99ce27c2b3babdb23e061a5a178ddc
Formbook
a4b5237de09448f0adfe3cf6838fad36eaaeb192634bf0ea71bd525699c02dff
Formbook
b08439619eb9a7986938fbb7dfbb6b36999937e531c9b739d45fe5373af5b71a
Formbook
b1e9060288c5c28d0fb5ba1c91b5c507e15011a063009da3e382ad6b90b09790
Formbook
bb8e1d48225b002a4da7d0c33051e7fc457e244ed610f536b87702439d978a46
Formbook
+ 11'645 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:io66 loader rat
Link:
https://tria.ge/reports/211124-jhjy5afda6/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.dymetaverse.com/io66/
Unpacked files
SH256 hash:
2331d3d223756ef6d008413d8c220e31b49833f36c4b800d08bc944c6fc3ee2b
MD5 hash:
b19432a01c447ef289fb8382682b16bb
SHA1 hash:
f9e58bf0f5ded0cf0a2b70cb5526a9ebf02a00c6
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/cd418ce0-1d45-410e-bbea-b847fde95883/
Parent samples :
87b30f92275cf7dbcc9a89aad43219b0415e7459448b328a98bfef1257c5bbc8
4adcae40731cb2729fc62542c0e6c48717d461fa0f203be15c0cfd39f8b4ffea
6a44e4ffb0822741c069cc807f9b1ff3937273a3b466810493bb437a6d5e98c7
2c68bd37fabbedd352ee351197d915993eb6a7c170733edbaf4272b5d8b7b5c5
SH256 hash:
298a31993853244d8ffa7f458aa904c3fc035e1e3b0505f3085d3b449e807c3b
MD5 hash:
946ca755e0e50b9c7644b1fb0a1f130b
SHA1 hash:
99baefb0480f4c02bdfcb47ba8062b18a096a556
Link:
https://www.unpac.me/results/cd418ce0-1d45-410e-bbea-b847fde95883/
SH256 hash:
1dca9bcaa1af3b8ba61590e52beb61672da7bd821f159d5d9e962f08ac051108
MD5 hash:
b6a36059c8b63204135037ab5910b23b
SHA1 hash:
4fbb8c2e1224b1549b2e4292ed7431cd2e2513c6
Link:
https://www.unpac.me/results/cd418ce0-1d45-410e-bbea-b847fde95883/
SH256 hash:
f30ca642597c059f9dbcc6cfea27687245fbcaf5456be0b7a4528d946f3a0a05
MD5 hash:
0f6349011cf5446131faf0cadbace87b
SHA1 hash:
0cd48b5cb5a0ca095043c333c9002ba5273e92e8
Link:
https://www.unpac.me/results/cd418ce0-1d45-410e-bbea-b847fde95883/
SH256 hash:
4adcae40731cb2729fc62542c0e6c48717d461fa0f203be15c0cfd39f8b4ffea
MD5 hash:
eeab5d28902fb4aff988c480067be6c5
SHA1 hash:
1b7e4910be82696337d911096c0433b088e4d5ee
Link:
https://www.unpac.me/results/cd418ce0-1d45-410e-bbea-b847fde95883/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4adcae40731c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/4adcae40731cb2729fc62542c0e6c48717d461fa0f203be15c0cfd39f8b4ffea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 4adcae40731cb2729fc62542c0e6c48717d461fa0f203be15c0cfd39f8b4ffea

(this sample)

  
Dropped by
xloader
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/208876/

Comments