MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 633ad8beecf7e68a344492aa6722033b10aeb60cdf3ddeb2bc67dfa42efb16af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 633ad8beecf7e68a344492aa6722033b10aeb60cdf3ddeb2bc67dfa42efb16af
SHA3-384 hash: 6a0c826c9fb9e0e26f76fab17e238ec0c31ef00b5085a1f26cd4505b4268656a53f49742895a9c9a360db3e358cca2e3
SHA1 hash: 9eb8b9f6666867edda81bd723e9dcdd73c1a9233
MD5 hash: 06ea487f4bf22ed99336038482d6a24b
humanhash: fix-double-mike-social
File name:06ea487f4bf22ed99336038482d6a24b.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:487'424 bytes
First seen:2021-12-20 15:26:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:Ju2iNiuSK3AhdV7NQ8QBRhy6RiC/j11f9RfAJivXCktGG:k1PSK3AhdVJpQ34IGG
Threatray 12'402 similar samples on MalwareBazaar
TLSH T16EA4F24CF923EAB8E96803B835B19D111F72D616A4ADDA7D2D8737AA0435342109FDCF
File icon (PE):PE icon
dhash icon b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/215492/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm obfuscated packed
Link:
https://www.filescan.io/uploads/61c0a0ca8991ba72b38eaf4b/reports/e56697bf-620c-4544-bf79-94c2564a50c1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/64efd650-3162-4bf6-b825-2b6848b4b5d3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/910366
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 542845 Sample: Mqr61ws4nt.exe Startdate: 20/12/2021 Architecture: WINDOWS Score: 100 32 www.bandartogel2022.com 2->32 34 parkingpage.namecheap.com 2->34 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 7 other signatures 2->44 11 Mqr61ws4nt.exe 3 2->11         started        signatures3 process4 signatures5 54 Tries to detect virtualization through RDTSC time measurements 11->54 56 Injects a PE file into a foreign processes 11->56 14 Mqr61ws4nt.exe 11->14         started        process6 signatures7 58 Modifies the context of a thread in another process (thread injection) 14->58 60 Maps a DLL or memory area into another process 14->60 62 Sample uses process hollowing technique 14->62 64 Queues an APC in another process (thread injection) 14->64 17 explorer.exe 14->17 injected process8 dnsIp9 28 www.unidasbrasil.com 17->28 30 web216.uni5.net 191.6.210.28, 49773, 80 IPV6InternetLtdaBR Brazil 17->30 36 System process connects to network (likely due to code injection or exploit) 17->36 21 colorcpl.exe 17->21         started        signatures10 process11 signatures12 46 Self deletion via cmd delete 21->46 48 Modifies the context of a thread in another process (thread injection) 21->48 50 Maps a DLL or memory area into another process 21->50 52 Tries to detect virtualization through RDTSC time measurements 21->52 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/633ad8beecf7e68a344492aa6722033b10aeb60cdf3ddeb2bc67dfa42efb16af/
Threat name:
Win32.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 15:27:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
11 of 43 (25.58%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0789b4aec138cf9c5bc3b01774fc8ed075dadf40c8ecf97058c201c9de22160e
Formbook
425d46c51bf681a37b1f34a602ebf6c7f571060bf698e70f2fd495169f804f92
Formbook
47b3c7d88103ff95fa9a87b1b71e9ce815a745cc895394680b777590b98aac60
Formbook
4d88b7c45db03545e9efd2f6e07d838849a43594f6a425c05189ca93317a667b
Formbook
58d05ac8e9716f4322f5d39d676a3415c7f499e99c8fa5d920bbbecdb4a616b7
Formbook
6bb763ffd1ca484344f2a02df3f9e6bddc18a0f1fcd5d58002ad16b82b36db90
Formbook
754d0c2b1277e1c89a1220f33cdb795900b882bfb5b0fc003b1880e55c4fbec1
Formbook
8ddc14ac94185fbe27b3764fb4e24fd8c25626a465074e8f640955a6f3409c08
Formbook
bb6c08035fd7dc06d3ace7952af7bd640c45c548e087dba1deaa45f1861b0077
Formbook
c63cb761da677849b8382eb1d926569f00a04d57f2c789b63e7f2eb2e368a00c
Formbook
+ 12'392 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:c3f6 rat spyware stealer trojan
Link:
https://tria.ge/reports/211220-svrdeabac2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Unpacked files
SH256 hash:
9e7d7705c5be32083f8c108f7605ef81470ca87679e8b351168702632e3b944e
MD5 hash:
ab6ae737146ae3855e1444529feb4b64
SHA1 hash:
43df553db8d0f3bd4b2ee9e6b7bfe348ebc2aad7
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/3367da56-2b5d-4309-b58f-cc102e3fb763/
Parent samples :
55028ddc6704717154ae4a43603da57d1099caee821c64c92722519f00c88e6d
c5c6248caa8d0e035434be7fefacaacdc490b1f763917683db5270cfe7d289aa
58d05ac8e9716f4322f5d39d676a3415c7f499e99c8fa5d920bbbecdb4a616b7
754d0c2b1277e1c89a1220f33cdb795900b882bfb5b0fc003b1880e55c4fbec1
633ad8beecf7e68a344492aa6722033b10aeb60cdf3ddeb2bc67dfa42efb16af
SH256 hash:
02a8b3bf270efd50f7d155045b677a2826363ee78a3d8288690c466ed5ffb478
MD5 hash:
a187dc63bf01b6b06b04411344bab8d6
SHA1 hash:
b8b853f3f86ecfe8c7fcaafa7995231e6493f847
Link:
https://www.unpac.me/results/3367da56-2b5d-4309-b58f-cc102e3fb763/
SH256 hash:
9f5763966bacdc6de3944a6e06a49b05869c38f2e98b32cb93b483a480a6ffff
MD5 hash:
3418c620c4b9dd4533a88f1ba5ec3ff1
SHA1 hash:
12f6aaf1c90030c4063d42a27b2e7000a08b6e74
Link:
https://www.unpac.me/results/3367da56-2b5d-4309-b58f-cc102e3fb763/
SH256 hash:
633ad8beecf7e68a344492aa6722033b10aeb60cdf3ddeb2bc67dfa42efb16af
MD5 hash:
06ea487f4bf22ed99336038482d6a24b
SHA1 hash:
9eb8b9f6666867edda81bd723e9dcdd73c1a9233
Link:
https://www.unpac.me/results/3367da56-2b5d-4309-b58f-cc102e3fb763/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/633ad8beecf7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/633ad8beecf7e68a344492aa6722033b10aeb60cdf3ddeb2bc67dfa42efb16af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 633ad8beecf7e68a344492aa6722033b10aeb60cdf3ddeb2bc67dfa42efb16af

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1871135/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/215492/

Comments