MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f0508408689f77795e27f5320115355744c6b7d02cf59197dae8646bc73f267. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f0508408689f77795e27f5320115355744c6b7d02cf59197dae8646bc73f267
SHA3-384 hash: be557589a3456db0a4d1f8340bb9a886249f28a9d8b17c45dcbf49b5ac20b17f8e224f9e5447c515b7a29a4ac9f058e5
SHA1 hash: 2ed397d5b902e367bae3f07848c258b63f669997
MD5 hash: 75c063f3e5bc2c6d22d69808c5f05f23
humanhash: pasta-juliet-oklahoma-floor
File name:banco_transferencia0280222.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:55'296 bytes
First seen:2022-02-28 15:54:30 UTC
Last seen:2022-02-28 17:30:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 768:PuBAt5bC8+GhuF3o8C+7Qqnqf0e2AYgzru7xlmMwCK/3deVD5:2BAv1+GwF3o88qqf+T37630VD5
Threatray 13'771 similar samples on MalwareBazaar
TLSH T1F743F51678AA8619C1D8BBFCD9B2916323356CF55120C08FA8FB3F16A932363DDC525D
File icon (PE):PE icon
dhash icon 174f4559191b1b13 (81 x AgentTesla, 68 x Formbook, 34 x SnakeKeylogger)
Reporter malwarelabnet
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/245395/
Detection(s):
SecuriteInfo.com.W32.Trojan.UTQN-2186.25061.4472.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware obfuscated packed shell32.dll update.exe
Link:
https://www.filescan.io/uploads/621cf065dfdfa8501c6c2802/reports/b9ae6a8a-c08c-4277-a423-14e207557aa4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/579c7baf-0477-4a85-a870-58906a3318d7
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/947525
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 580006 Sample: banco_transferencia0280222.exe Startdate: 28/02/2022 Architecture: WINDOWS Score: 100 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Antivirus detection for URL or domain 2->39 41 6 other signatures 2->41 10 banco_transferencia0280222.exe 15 3 2->10         started        process3 dnsIp4 29 103.50.162.146 PUBLIC-DOMAIN-REGISTRYUS India 10->29 31 172.217.168.14 GOOGLEUS United States 10->31 33 8.8.8.8 GOOGLEUS United States 10->33 27 C:\...\banco_transferencia0280222.exe.log, ASCII 10->27 dropped 51 Tries to detect virtualization through RDTSC time measurements 10->51 15 banco_transferencia0280222.exe 10->15         started        file5 signatures6 process7 signatures8 53 Modifies the context of a thread in another process (thread injection) 15->53 55 Maps a DLL or memory area into another process 15->55 57 Sample uses process hollowing technique 15->57 59 Queues an APC in another process (thread injection) 15->59 18 explorer.exe 15->18 injected process9 process10 20 colorcpl.exe 18->20         started        signatures11 43 Self deletion via cmd delete 20->43 45 Modifies the context of a thread in another process (thread injection) 20->45 47 Maps a DLL or memory area into another process 20->47 49 Tries to detect virtualization through RDTSC time measurements 20->49 23 cmd.exe 1 20->23         started        process12 process13 25 conhost.exe 23->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f0508408689f77795e27f5320115355744c6b7d02cf59197dae8646bc73f267/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-02-28 09:45:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n4cqqqegrh3xpfpcp5jsaektkv2ey235alhvsgl5v2denpdt6jtq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0aeac649d2d859f9f98e5545017913ed1e3270ba4d46602c2cac3adbe03dea40
Formbook
204831bda7d04f0905f7bf0c39e45b3772935726d8a436ee9703a19098b37e21
Formbook
335fa8671bb1ef8659247de4bed05898512fb3a056ef6deb31849eefef8a4743
Formbook
3a4c026f2e3c450b18931610d6a795ffe504c41ca1d4bf7d26c5a7a57abcf389
Formbook
502303edd5a9de57b3667146e84f15fc4957242ca2ef8f75f5e503946c452ee2
Formbook
52b3b8d10c143dd7b6dfc186bf1e1e0e3c47c3f995dec4e1e4f5f569075d9a38
Formbook
53685ac5f275b61fc580f2203e7d7e431d2b03b8e4320015b428745d68d5e333
Formbook
9050768f69225078f05d535401510a5b361dd071430e40639e869c7247621908
Formbook
ad3a7da76a9ef70a26cf3c5b87541184fb26adfdb3faac401b057f4c76a19712
Formbook
b8ab74dd84edb28eb65b60019e3420a82747b46e1d10d016dbf74fee5edb7ecb
Formbook
+ 13'761 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:uar3 loader rat
Link:
https://tria.ge/reports/220228-tcsdeseeh5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blocklisted process makes network request
Xloader Payload
Xloader
Unpacked files
SH256 hash:
6f0508408689f77795e27f5320115355744c6b7d02cf59197dae8646bc73f267
MD5 hash:
75c063f3e5bc2c6d22d69808c5f05f23
SHA1 hash:
2ed397d5b902e367bae3f07848c258b63f669997
Link:
https://www.unpac.me/results/4f51befd-02e2-4930-bc03-2d1f9872b92f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/6f0508408689f77795e27f5320115355744c6b7d02cf59197dae8646bc73f267

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/245395/

Comments