MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6440e29b946df58c3cbd6ecdfb42ae88bb42d19b892bce094abf6834019c051f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6440e29b946df58c3cbd6ecdfb42ae88bb42d19b892bce094abf6834019c051f
SHA3-384 hash: ecbbdc126c57cda94f0c1e9ad89d9c8ac1e39d9d71cd40085dbd75f1c7e227c7fb2f170efc9a1789557d73ab336f00f3
SHA1 hash: 92705faddead19db804e2c4d919f661afe0c3453
MD5 hash: 83b2d40ea6befc3d84aa4a074b44d883
humanhash: texas-rugby-summer-cup
File name:PO#202110223.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:366'592 bytes
First seen:2021-10-28 12:57:00 UTC
Last seen:2021-10-29 10:08:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:W7NHQMDjf3hyGJoYMgOeTg1xWgFJ45MdzduRPm7wWyNJf3yMhb:8HQMHfRy8/Oegc5Mdzd4ewWWxb
Threatray 10'883 similar samples on MalwareBazaar
TLSH T1C7740211B398AB93C47C43F95493A96493F12E2736B0DB052EE224D92E737809E85FD7
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200934/
Detection(s):
SecuriteInfo.com.MachineLearning.Anomalous.97.3476.9643.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware obfuscated packed
Link:
https://www.filescan.io/uploads/617a9e209a5a1e91c5d9dd35/reports/e7a3eb55-ebeb-471f-9774-6c68e94e6865/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7c8629d4-c1ad-4d10-ab9b-dca3f59c0d5b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/878590
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 511024 Sample: PO#202110223.exe Startdate: 28/10/2021 Architecture: WINDOWS Score: 100 33 www.minxsystem.com 2->33 35 www.industrialrocketlamp.com 2->35 37 3 other IPs or domains 2->37 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 7 other signatures 2->51 11 PO#202110223.exe 3 2->11         started        signatures3 process4 file5 31 C:\Users\user\...\PO#202110223.exe.log, ASCII 11->31 dropped 65 Tries to detect virtualization through RDTSC time measurements 11->65 67 Injects a PE file into a foreign processes 11->67 15 PO#202110223.exe 11->15         started        18 PO#202110223.exe 11->18         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 15->69 71 Maps a DLL or memory area into another process 15->71 73 Sample uses process hollowing technique 15->73 75 Queues an APC in another process (thread injection) 15->75 20 explorer.exe 15->20 injected process9 dnsIp10 39 www.lexhire.com 74.220.199.6, 49764, 80 UNIFIEDLAYER-AS-1US United States 20->39 41 www.credit-suisse-csx.com 103.224.182.246, 49760, 80 TRELLIAN-AS-APTrellianPtyLimitedAU Australia 20->41 43 12 other IPs or domains 20->43 53 System process connects to network (likely due to code injection or exploit) 20->53 55 Performs DNS queries to domains with low reputation 20->55 24 help.exe 20->24         started        signatures11 process12 signatures13 57 Self deletion via cmd delete 24->57 59 Modifies the context of a thread in another process (thread injection) 24->59 61 Maps a DLL or memory area into another process 24->61 63 Tries to detect virtualization through RDTSC time measurements 24->63 27 cmd.exe 1 24->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6440e29b946df58c3cbd6ecdfb42ae88bb42d19b892bce094abf6834019c051f/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-10-28 12:57:06 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mraofg4unx2yypf5n3g7wqvorc5ufum3rev44ckkx5udiam4aupq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
09b4fb11c410620d69ddc6caf95405f3d10005726c2953ac99f56547f81942b0
Formbook
1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
Formbook
26506e7d3f4821066fc1989a5c79afb4d1a316aa428f9e4a920644d93a80b495
Formbook
5d5aa4f1afaa9dd98bc1317f5b8e190cf21130d465da575fac9d4fbc6b3fb3af
Formbook
73db754f5e709731e9c07c230fa6512ee75e07184c367e3f80b1bf646e7b72da
Formbook
7b11c921e5383232009985b5912967978ae269287359f9c1718c2b37e1a067f8
Formbook
d2c3619f62ee7f09594134678d02e47d6a0b71a5e203f3edae6a9f5dbecb4f48
Formbook
d3c68ebad6229b1da92061291639f9b48e3f76fd4c524a9850b4fbb311e180f8
Formbook
e1010d989d5412e83aaf07bf794a76257b1a43bcec34dd8c05280cb97c61e3ec
Formbook
+ 10'873 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:op08 loader rat
Link:
https://tria.ge/reports/211028-p6x4jsbfb7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.jjmpestman.com/op08/
Unpacked files
SH256 hash:
f60ee528f75066ab83ac0cabfbc064dacc001616f67e4e921ee0530439902428
MD5 hash:
89ef18606ae05e0dacbb3f2b1865cdd3
SHA1 hash:
29db8013fbb15ab280292b70744b713a9fa0ae81
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/412a0b4d-69b4-46fd-a24f-c8c116ad3e03/
Parent samples :
6440e29b946df58c3cbd6ecdfb42ae88bb42d19b892bce094abf6834019c051f
28b77890ae9535db2da6bf03e7c41471d173b86fa67b907dafa38aede34fc148
5b353b83719d0a2f4a9f5ad11894c5c2129ae67e28a1f8677150a03623ab21f9
SH256 hash:
09c2fe901e762f78d795f59c836950e23295bdcfc232a3414d6eacc672a787a5
MD5 hash:
294510dc58ec4710627446097b01502f
SHA1 hash:
c269cf42ebfe1a6bf773eea338052149655eec07
Link:
https://www.unpac.me/results/412a0b4d-69b4-46fd-a24f-c8c116ad3e03/
SH256 hash:
4d1ee061c817ea30ca4e461a4f44388662c1c1c2775be2b323858ddbc1679b35
MD5 hash:
1b6d3d31872537cc611ff4322ffc1099
SHA1 hash:
0108adafb207ce044bfb3f7933da45594c545bee
Link:
https://www.unpac.me/results/412a0b4d-69b4-46fd-a24f-c8c116ad3e03/
SH256 hash:
6440e29b946df58c3cbd6ecdfb42ae88bb42d19b892bce094abf6834019c051f
MD5 hash:
83b2d40ea6befc3d84aa4a074b44d883
SHA1 hash:
92705faddead19db804e2c4d919f661afe0c3453
Link:
https://www.unpac.me/results/412a0b4d-69b4-46fd-a24f-c8c116ad3e03/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/6440e29b946df58c3cbd6ecdfb42ae88bb42d19b892bce094abf6834019c051f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 6440e29b946df58c3cbd6ecdfb42ae88bb42d19b892bce094abf6834019c051f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/200934/

Comments