MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 602b9e5b584b67abd5573952c8633272e414dd6cde6485b9722cf780d809297a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 602b9e5b584b67abd5573952c8633272e414dd6cde6485b9722cf780d809297a
SHA3-384 hash: 28dd72a3ee52d8ba4f261a2a22bdc7569886937711f8424ce1424da89c83a0cca95b028fa9f71c47871936c57954dd56
SHA1 hash: c07355cb770a36c75a1aff71d9084c1b58342f77
MD5 hash: c2967abe99e9fc84c4b1df1b91ee2089
humanhash: fruit-alanine-sink-papa
File name:SecuriteInfo.com.ArtemisC2967ABE99E9.17436.10643
Download: download sample
Signature Formbook
Create hunting rule
File size:710'144 bytes
First seen:2021-06-09 23:37:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 6144:E97fWQ42fme0R72a2htoGhsj9yZ87F2Q7IsnBuhn7A3MCT9rEWkLuA5YfVtUvVE9:y4ITi7jgSj8eSnU3rEWKuaY9qI
Threatray 5'648 similar samples on MalwareBazaar
TLSH 5AE4AE01B6A89B11E9BA5BF10A70959047F6BD3B6579E01C4CDA72EB0FB3F0049A1F17
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.ArtemisC2967ABE99E9.17436.10643
Verdict:
Malicious activity
Analysis date:
2021-06-10 09:31:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a2ed4897-b263-4295-8ca0-fc314a367e36

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/165724/
Detection(s):
SecuriteInfo.com.ArtemisC2967ABE99E9.17436.10643.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/799897
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/602b9e5b584b67abd5573952c8633272e414dd6cde6485b9722cf780d809297a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-09 22:57:16 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mavz4w2yjnt2xvkxhfjmqyzsolsbjxlm3zsilolsft3ybwajff5a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3afb8f6f86741e036ed7ee941f4875344c2b384d6e9d21c85755bfbce63ee473
Formbook
47c26ad6ad20462404f1f13c5be9024a1f602452aca247b7c6de059a09dfa3ee
Formbook
6fac6e1f7f8cdd8cec52b2dd7a23fd434084c7d12ef0f04deaa52794d3612ef7
Formbook
7c201535a28746b62adfa831cfccac096903f5b17ee83b8364fc890fa70a59fd
Formbook
92ec0fdda57232d435885971959cc65ede66e19f7ea7673798e97344008369fd
Formbook
975d26e2e3cbc36e78c184a98bff54686261c65bba363d93391076b6a248b486
Formbook
b5e3426a888ddb5751f9802093f1bd10ec696b2994bee03b99b7ba2b4f21a57d
Formbook
d3a729cac68f5147eb5b7a4e288196b37d0e7a02305529c591b060bcd36a843d
Formbook
ebe1f420ea3fcef5b426cf6458d23984e12c4ceb5983571699f60aaa963b159a
Formbook
fb3912c5b687ea7412dc249538d7c02b790f6edde2f23497c05faabd848cb16c
Formbook
+ 5'638 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210609-f5myq9mzre/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.cannabisoutletonline.com/n86i/
Unpacked files
SH256 hash:
4295f0709d06e0dc89dac51175cb1ad8298fa6cea129d6ec68d6384dbe408848
MD5 hash:
3aa99f67ca860c3e8a1f50c23ae6d4e0
SHA1 hash:
2e5ab2cea15a7e193cb0daaefcac739172fd7eed
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/4ec0691f-b3fc-482a-8db3-3a1600b884ef/
Parent samples :
602b9e5b584b67abd5573952c8633272e414dd6cde6485b9722cf780d809297a
71f5a0e02cfd97625bfaf4c5e48825b8b08262a7ac89f1b7f8ae82c1200205f8
02975da56cdb081486ce1a26edab47c4d1930d3a3fb3af09b88e5704f1cb82a9
41d1ffa0d55a6c7e6758afe11084539691922714455663d641e1be3c8e4d9977
f424c1c0133274cfa86291baae19bc09f707ccbb012f2f55a873c37c1628641d
0edae7978eb5ab1138773892d324b8f03b4494db3a553045ab568a96f48051a4
148ae566cc7845712fb357b42b86219e8ee2bb2d2308753f6fc69394deacbe55
ddc1d5dd3d2d2a64d1d3e7586023715a1da59c30af9682843d326e0f16f12632
SH256 hash:
4ea9811c46ec052ff1037c3942f2e0a3a36c197d1c66f20734590e7152af0cf0
MD5 hash:
17093e2328d32cefc386f5f3dc5a2edd
SHA1 hash:
dfb5dfd93a72cc5904083b689b3398fff2e14e06
Link:
https://www.unpac.me/results/4ec0691f-b3fc-482a-8db3-3a1600b884ef/
SH256 hash:
5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6
MD5 hash:
072eeac61b35d3f09edee4ff4f80f52d
SHA1 hash:
696fd9905a47e526470c2e234fef32f1ec1b74ad
Link:
https://www.unpac.me/results/4ec0691f-b3fc-482a-8db3-3a1600b884ef/
SH256 hash:
602b9e5b584b67abd5573952c8633272e414dd6cde6485b9722cf780d809297a
MD5 hash:
c2967abe99e9fc84c4b1df1b91ee2089
SHA1 hash:
c07355cb770a36c75a1aff71d9084c1b58342f77
Link:
https://www.unpac.me/results/4ec0691f-b3fc-482a-8db3-3a1600b884ef/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.71
Link:
https://yomi.yoroi.company/submissions/602b9e5b584b67abd5573952c8633272e414dd6cde6485b9722cf780d809297a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/165724/

Comments