MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52c83128a5afe81533f6683e9fe4d53c6a00dd3b0650ee6136528114bef6117e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52c83128a5afe81533f6683e9fe4d53c6a00dd3b0650ee6136528114bef6117e
SHA3-384 hash: c174f004ef9bed667e144569b0b056435b03b8e65cc614d9331cb1fe984abe04838bdee85a11e4f0fa73c4f27ffc4325
SHA1 hash: 57ad5cab0dbaee64deb8366e96fd8eed14818ec9
MD5 hash: 15a8a234e02e1eda15b80bb2cc3a1ff9
humanhash: lactose-alabama-golf-summer
File name:http___103.133.106.199_www_vbc.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:494'080 bytes
First seen:2021-09-10 06:28:53 UTC
Last seen:2021-09-10 12:00:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:QHtx898xTk4DbF53e0IUFLLAr0yYq1eGRNc2Ui7qRhVS6GL97pm:6n+0yYqIwshVSlj
Threatray 9'195 similar samples on MalwareBazaar
TLSH T1F2B4AE243DFA5119F1B3AFB55AE0B4868A6FF6733A83E45D1481038B4623F81FD9153A
dhash icon 022c5b52a6a456a9 (8 x Formbook, 7 x AgentTesla, 3 x Loki)
Reporter Racco42
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/186801/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.26086.24338.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/523e7c05-f74f-4fad-8f46-46fcce45d9fd
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/848617
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/52c83128a5afe81533f6683e9fe4d53c6a00dd3b0650ee6136528114bef6117e/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-10 06:15:14 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
24dcd158651778db622e7ad72d70bce9ccd66ad754357285b9d3399c5dcb33d9
Formbook
2c5763d9d89f5d97d070891d79c01e1e534a8f626dce226a5b606a9bc999b56d
Formbook
36c5cccf34914902e9e6f2a53f30d3efb3215aa9d7516a5e56ab97d2a287ac51
Formbook
55e967fecbdcb5166af6a5a6b8d09db0ca26582ed70d170a248a4d1e69c9a8c9
Formbook
61be8eb2905c08febca2821b39701ea6a361ae21e807866d240b3b122221cf62
Formbook
ba16d80b218d269fcc8beb82c0c21b9533f5976fd2af0c873d5598e6f4e90307
Formbook
cb5d83a08a825fccf4a52e24c65f51b995ec34053194d7ff749fced8cc5d3fc6
Formbook
ce5200f83fa5cb0f31b93edbfbc372e3d93bc71450f77ba705b452ca523e24e5
Formbook
+ 9'185 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:ez2z loader rat
Link:
https://tria.ge/reports/210910-g8yh4aheg9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.chriswrightt.com/ez2z/
Unpacked files
SH256 hash:
e0c99291ae7b961fe14792c39ed22172f1a407161c66b3e7a58a61e56774072f
MD5 hash:
6435a3d6fb444d2e8679ee00b1b2f25b
SHA1 hash:
37419ce689c6cbbcbd27daa44b5e35088be3e91c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/aba1a1e9-7830-40e9-82ca-419751b38735/
Parent samples :
cb5d83a08a825fccf4a52e24c65f51b995ec34053194d7ff749fced8cc5d3fc6
ba16d80b218d269fcc8beb82c0c21b9533f5976fd2af0c873d5598e6f4e90307
36c5cccf34914902e9e6f2a53f30d3efb3215aa9d7516a5e56ab97d2a287ac51
52c83128a5afe81533f6683e9fe4d53c6a00dd3b0650ee6136528114bef6117e
19445d7251f9c133c6bf786d987a6e333f6fcb0832f974a273ab73202a2e40c9
SH256 hash:
ad4a7895d529d5164302bb88596964ab42ff125bf0f5544418c80b6d438cb587
MD5 hash:
43ababb6b0a02907aad43084f12b10d9
SHA1 hash:
b60ba705891d5a666d64300181b475a46714ffa8
Link:
https://www.unpac.me/results/aba1a1e9-7830-40e9-82ca-419751b38735/
SH256 hash:
e143bd15c0b8d205dab477e29e46c8651c42619e2d43abcdac2ddc431ea22e65
MD5 hash:
a0861a1c52872c158f51ba31ebbb940b
SHA1 hash:
648f8f7c2ed4752916a4b80aa536323f61b61c06
Link:
https://www.unpac.me/results/aba1a1e9-7830-40e9-82ca-419751b38735/
SH256 hash:
52c83128a5afe81533f6683e9fe4d53c6a00dd3b0650ee6136528114bef6117e
MD5 hash:
15a8a234e02e1eda15b80bb2cc3a1ff9
SHA1 hash:
57ad5cab0dbaee64deb8366e96fd8eed14818ec9
Link:
https://www.unpac.me/results/aba1a1e9-7830-40e9-82ca-419751b38735/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/52c83128a5afe81533f6683e9fe4d53c6a00dd3b0650ee6136528114bef6117e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/186801/

Comments