MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67af71fb0f05689aeca3a7ad228178ba5b1e5cf99a8b6f830c3c3f79ec1d056a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67af71fb0f05689aeca3a7ad228178ba5b1e5cf99a8b6f830c3c3f79ec1d056a
SHA3-384 hash: 74dbd62a69c7f88e9c66418b0e319a881b77c16581753ed19014e476780119f166062dc1e682dd3905ddbd527c6b8974
SHA1 hash: 9d6ab361f44153f5dfbc0145fc1e3e7eff46e15c
MD5 hash: 4ba41e6b26d44d92dcfd33374017a113
humanhash: robert-ceiling-butter-uranus
File name:MV SEA CREDENCE_VENDOR-TEMPLATE_FORM.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:450'048 bytes
First seen:2022-06-25 08:49:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:c933zCIb4R3huac1kDUofIRqRcHQ2KVMTwHqZuUJ/Rf4BHtna:CzCIkBc6DJIa0TwrUdRg5tn
TLSH T1F5A43D9C3B051A66FF1FD07886130A44BBE22F233280998357EF29C9975E5677F05D8A
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 337169795969612b (1 x Formbook)
Reporter Anonymous
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/283235/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Running batch commands
Creating a file
Creating a file in the %AppData% subdirectories
Launching cmd.exe command interpreter
Searching for synchronization primitives
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook obfuscated packed wacatac
Link:
https://www.filescan.io/uploads/62b6cc527e9a4f0a86e0218c/reports/59762479-3d74-4489-8655-99e5a942610d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/080c8597-6df1-43f4-8ef0-2f42ba0c5e3d
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1019705
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Binary or sample is protected by dotNetProtector
C2 URLs / IPs found in malware configuration
Drops PE files with benign system names
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 652201 Sample: MV SEA CREDENCE_VENDOR-TEMP... Startdate: 25/06/2022 Architecture: WINDOWS Score: 100 60 Multi AV Scanner detection for domain / URL 2->60 62 Malicious sample detected (through community Yara rule) 2->62 64 Antivirus detection for URL or domain 2->64 66 6 other signatures 2->66 7 Svchost.exe 1 2->7         started        11 MV SEA CREDENCE_VENDOR-TEMPLATE_FORM.exe 2 2->11         started        13 Svchost.exe 2->13         started        process3 file4 50 C:\Users\user\AppData\...\Svchost.exe.log, ASCII 7->50 dropped 72 Multi AV Scanner detection for dropped file 7->72 74 Machine Learning detection for dropped file 7->74 76 Writes to foreign memory regions 7->76 78 2 other signatures 7->78 15 cmd.exe 1 7->15         started        17 cmd.exe 1 7->17         started        19 vbc.exe 7->19         started        52 MV SEA CREDENCE_VE...MPLATE_FORM.exe.log, ASCII 11->52 dropped 21 cmd.exe 1 11->21         started        24 cmd.exe 3 11->24         started        27 vbc.exe 11->27         started        29 MpCmdRun.exe 1 11->29         started        signatures5 process6 file7 31 conhost.exe 15->31         started        33 schtasks.exe 1 15->33         started        35 conhost.exe 17->35         started        37 WerFault.exe 2 9 19->37         started        68 Uses schtasks.exe or at.exe to add and modify task schedules 21->68 70 Drops PE files with benign system names 21->70 39 conhost.exe 21->39         started        41 schtasks.exe 1 21->41         started        54 C:\Users\user\AppData\Roaming\...\Svchost.exe, PE32 24->54 dropped 56 C:\Users\user\...\Svchost.exe:Zone.Identifier, ASCII 24->56 dropped 43 conhost.exe 24->43         started        45 conhost.exe 24->45         started        47 WerFault.exe 23 9 27->47         started        signatures8 process9 dnsIp10 58 192.168.2.1 unknown unknown 47->58
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/67af71fb0f05689aeca3a7ad228178ba5b1e5cf99a8b6f830c3c3f79ec1d056a/
Threat name:
ByteCode-MSIL.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2022-06-16 02:53:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6xxd6ypavujv3fdu6wsfalyxjnr4xhztkfw7aymhq7xt3a5avva._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:9q2j loader persistence rat spyware stealer suricata
Link:
https://tria.ge/reports/220625-krk38adfem/
Behaviour
Creates scheduled task(s)
Gathers network information
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Adds policy Run key to start application
Executes dropped EXE
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Unpacked files
SH256 hash:
8e7e7cfaa5d71bcd8b20f40096ac7a600fdd9cfb826896aadd544dc0a70d931b
MD5 hash:
a30747788734b7b30ec768eca6625bba
SHA1 hash:
d07bf94c72594e64593fdb696ea547ff20481cb5
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
XLoader
Create hunting rule
Link:
https://www.unpac.me/results/553be712-d20f-4d7c-a28a-e02d33238fd5/
Parent samples :
9cbf58842ab2082dfb22e1f53939cd2d1dd66b551a4d9ec397ae558f35e5475f
40c4346a171db5d06a7e6002ff7307b559403662fc749c0f1de4d246f29dd411
b20ad6c8dd8844751924260b1fdf4527d6ca6629d8df09140733e88a7eae9db7
67af71fb0f05689aeca3a7ad228178ba5b1e5cf99a8b6f830c3c3f79ec1d056a
f2f1807e10def6ed679f26782bf880eb6246fcebb71e51bde767835cb1e1a5ed
SH256 hash:
67af71fb0f05689aeca3a7ad228178ba5b1e5cf99a8b6f830c3c3f79ec1d056a
MD5 hash:
4ba41e6b26d44d92dcfd33374017a113
SHA1 hash:
9d6ab361f44153f5dfbc0145fc1e3e7eff46e15c
Link:
https://www.unpac.me/results/553be712-d20f-4d7c-a28a-e02d33238fd5/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/67af71fb0f05/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/67af71fb0f05689aeca3a7ad228178ba5b1e5cf99a8b6f830c3c3f79ec1d056a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Babel
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Babel
Rule name:INDICATOR_EXE_Packed_Dotfuscator
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Dotfuscator
Rule name:INDICATOR_EXE_Packed_dotNetProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with dotNetProtector
Rule name:INDICATOR_EXE_Packed_Goliath
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Goliath
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/283235/

Comments