MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fd5c640f4c1e434978fdc59a8ec191134b7155217c84845ea6a313aecf25bcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fd5c640f4c1e434978fdc59a8ec191134b7155217c84845ea6a313aecf25bcc
SHA3-384 hash: 6ef089e9687a091c74d73784f8b7667c9b2d21a723ff7f7d7c303a8f50195eea26d7d8108af4950398f42fdd6f6a8d47
SHA1 hash: e04dc2a139d40b078542f35d18fbf8771f6fb38f
MD5 hash: 0a509e3ea3c1d1a6a778c6a4fd2f2c8f
humanhash: tango-speaker-black-alanine
File name:6FD5C640F4C1E434978FDC59A8EC191134B7155217C84.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:6'592'210 bytes
First seen:2021-10-26 00:20:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 196608:ypmr8XvO6VdB+Cqlu1bgp1aej05sX1wYe4SMeCS6ufoT3A:ydXvJVX+Cop1a02KC497YwTw
Threatray 1'469 similar samples on MalwareBazaar
TLSH T1206633109EA2D0D0D643A779BBD6728E0CAAF50DD66CA6114B189BCC399FE3DCD5C0E4
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Formbook C2:
135.181.79.37:52491

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
135.181.79.37:52491 https://threatfox.abuse.ch/ioc/237636/
193.56.146.64:65441 https://threatfox.abuse.ch/ioc/237637/

Intelligence

File Origin
# of uploads :
1
# of downloads :
303
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6fd5c640f4c1e434978fdc59a8ec191134b7155217c84845ea6a313aecf25bcc
Verdict:
Malicious activity
Analysis date:
2021-09-14 18:33:22 UTC
Tags:
trojan rat redline loader stealer vidar evasion
Link:
https://app.any.run/tasks/d4b17809-bc5f-4780-a1ac-20a4dbb44651

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DLInjector04
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200051/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Win.Packed.Socelars-9895020-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys overlay packed tiny
Link:
https://www.filescan.io/uploads/617749f09a5a1e91c5d350a4/reports/68445c6b-1619-4386-84bf-ccdf479c6c63/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Bsymem
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4111cee3-23d0-452e-972a-f6a1b9b55a58
Result
Threat name:
FormBook RedLine Socelars Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/876688
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Yara detected FormBook
Yara detected RedLine Stealer
Yara detected Socelars
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 509121 Sample: 6FD5C640F4C1E434978FDC59A8E... Startdate: 26/10/2021 Architecture: WINDOWS Score: 100 70 208.95.112.1 TUT-ASUS United States 2->70 72 20.42.65.92 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->72 74 2 other IPs or domains 2->74 92 Malicious sample detected (through community Yara rule) 2->92 94 Antivirus detection for URL or domain 2->94 96 Antivirus detection for dropped file 2->96 98 18 other signatures 2->98 10 6FD5C640F4C1E434978FDC59A8EC191134B7155217C84.exe 10 2->10         started        signatures3 process4 file5 46 C:\Users\user\AppData\...\setup_installer.exe, PE32 10->46 dropped 13 setup_installer.exe 19 10->13         started        process6 file7 48 C:\Users\user\AppData\...\setup_install.exe, PE32 13->48 dropped 50 C:\Users\user\...\Mon18f5301dae0540c32.exe, PE32 13->50 dropped 52 C:\Users\user\...\Mon18e615087746b06.exe, PE32+ 13->52 dropped 54 14 other files (7 malicious) 13->54 dropped 16 setup_install.exe 1 13->16         started        process8 dnsIp9 66 127.0.0.1 unknown unknown 16->66 68 192.168.2.1 unknown unknown 16->68 90 Adds a directory exclusion to Windows Defender 16->90 20 cmd.exe 16->20         started        22 cmd.exe 16->22         started        24 cmd.exe 16->24         started        26 9 other processes 16->26 signatures10 process11 signatures12 29 Mon18c3a9e0e86769b.exe 20->29         started        34 Mon1880b2136a63.exe 22->34         started        36 Mon180c18f0e308.exe 24->36         started        100 Adds a directory exclusion to Windows Defender 26->100 38 Mon18d74d9387e571e.exe 2 26->38         started        40 Mon1837b3d2bd16.exe 26->40         started        42 Mon18e2246802.exe 26->42         started        44 3 other processes 26->44 process13 dnsIp14 76 45.142.182.152 XSSERVERNL Germany 29->76 78 37.0.10.214 WKD-ASIE Netherlands 29->78 84 11 other IPs or domains 29->84 56 C:\Users\...\7BzAQ4Ye02ztWUz8FJ3dhI3a.exe, PE32 29->56 dropped 58 C:\Users\...\15Ba_YJwg6fPkEdNc0clHkL5.exe, PE32 29->58 dropped 60 C:\Users\user\AppData\...\toolspab2[1].exe, PE32 29->60 dropped 64 23 other files (7 malicious) 29->64 dropped 102 Detected unpacking (creates a PE file in dynamic memory) 29->102 104 Creates HTML files with .exe extension (expired dropper behavior) 29->104 106 Machine Learning detection for dropped file 29->106 108 Disable Windows Defender real time protection (registry) 29->108 86 2 other IPs or domains 34->86 110 Detected unpacking (changes PE section rights) 34->110 112 Detected unpacking (overwrites its own PE header) 34->112 114 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 34->114 116 Tries to harvest and steal browser information (history, passwords, etc) 34->116 80 162.159.130.233 CLOUDFLARENETUS United States 36->80 118 Antivirus detection for dropped file 36->118 120 Multi AV Scanner detection for dropped file 36->120 62 C:\Users\user\...\Mon18d74d9387e571e.tmp, PE32 38->62 dropped 88 2 other IPs or domains 40->88 82 8.8.8.8 GOOGLEUS United States 44->82 file15 signatures16
Detection:
vidar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6fd5c640f4c1e434978fdc59a8ec191134b7155217c84845ea6a313aecf25bcc/
Threat name:
Win32.Downloader.Zenlod
Create hunting rule
Status:
Malicious
First seen:
2021-09-14 00:12:42 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n7k4mqhuyhsdjf4p3rm2r3azce2lofksc7eeqrpkniytv3hslpga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
44f3c573b5d6d77d97c2ebf5d4a235da5aed3a18eb5b76ea420d262df0f3a826
Formbook
4cd754af5d3b9faa7e9626f79fccc35464224247a10f4d01ef502a0423e637a7
Formbook
4cfbdd8acdc923beeca12d94f06d2f1632765434a2087df7ac803c254a0adf9c
Formbook
72339997aa5cf9d313e2c7a44b8649d343a057cd45a6b190036bbed489cd828a
Formbook
79d1a0d0bd8b5672374ab7c97365a6b0276efc6755900cdbdcdb77019e69457a
Formbook
935099f2160f2dd5fec6a63ea02c81d80c0b2cbf712b0e48b386a81078a627dd
Formbook
aa9830b26f9c0db4c3da3c04a96199550b57251b56f8c4ccb922b264a24e8de1
Formbook
c03c8a4852301c1c54ed27ef130d0de4cdfb98584adef3dda2a096177016a18b
Formbook
c9371cc485825207fe107e6600c14cfd9049c34f74c8c7332f16a20afea88164
Formbook
+ 1'459 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:socelars family:vidar family:xloader botnet:706 botnet:8dec62c1db2959619dca43e02fa46ad7bd606400 botnet:937 botnet:ani campaign:s0iw aspackv2 backdoor discovery evasion infostealer loader rat spyware stealer suricata themida trojan vmprotect
Link:
https://tria.ge/reports/211026-anb12ahfal/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Accesses 2FA software files, possible credential harvesting
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
VMProtect packed file
Vidar Stealer
Xloader Payload
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
Raccoon
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
Vidar
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Win32/Kelihos.F exe Download 2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
Malware Config
C2 Extraction:
https://gheorghip.tumblr.com/
45.142.215.47:27643
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
http://gejajoo7.top/
http://sysaheu9.top/
http://www.kyiejenner.com/s0iw/
https://mas.to/@lilocc
Unpacked files
SH256 hash:
36d5afdcb0fa8d512656aa5a59f34018885bb1b9dd5cc0780766552809cfb45f
MD5 hash:
4f9c74430d72b9500a0d99cc28fc7a7e
SHA1 hash:
a67cf6a62a6cabec501aa2f14e97c48b71dbd97c
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
38046382500f1739883d2c53639ffbc5756843da7574fe3e6820724f522958e2
MD5 hash:
33600475b2cc5445df2d3809c3798311
SHA1 hash:
3cb60432de30b82e87b8b607e0180a7843128b5a
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
Parent samples :
aa79b859945459fd6d1363c35e68c9d2674a78f1fdee02b8ddfab9a8fa011b48
e96f083ab18199d6a745b0fb3a8852b863b94a906664570198c8277abe4195c6
a412840c44db8bca039ce13176d7d6b9be9b2cbd1ef81eb85cd2f0c9180f6511
bf9714f60c2b4b43cc0383b3155d9c737271916032051df041fed54d34f7c765
2c3382e9eb5bbbfe86a88f9d8a75557c3f60707af088ce5f1283ee7a33cc3fbf
a3f0b643265e9895b3291658516ce2b34eb06d585bd8ea77fd61fda26917e0d9
5c97c35e6537283493bbfcd8fa178157898e6d266a36eadb9ab23bbcef613efc
SH256 hash:
d1417ebebd174d666a6abc9481d65b39fc2d88559f7fd92ebb7e2f1ae93787db
MD5 hash:
70220a3ce6ffd34101b3770342505f2c
SHA1 hash:
b55c421634d8eeaec5c6193f34c04625d21a9ae9
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
c034ee0ed45c8278cf10e330a92220f7d33c2d3d10f2721c2acabcca552b6423
MD5 hash:
4df600c45dbfd49fa9e31134e8f47434
SHA1 hash:
f07d4411a7b3722206e9d17e94749819930cedcb
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
76dfed12190f13c429fbd4927ca86aba574101f0c34a7bb078e2f36c3f92c025
MD5 hash:
20db8d663190e8c34f8b42d54a160c2c
SHA1 hash:
eb45301ec9c5283634679482e9b5be7a83187bb5
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
99b60219b962baf00a994baa44893a4b51bdb185a7d156576a9eb0895656fdd4
MD5 hash:
92746f2cff13bc9ea96df5af77e359bd
SHA1 hash:
dbc9820f38559704e82ae0f8634c490e92264078
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
4eb196d5e8f68ae3f2cc5c28639db9c5a7dd77bcabfbfb421dbbaa9b21a37ac4
MD5 hash:
01847c238135f1dc5c95d78c0f2b849a
SHA1 hash:
d03ea754cc843d63e6dad9d091a6bec6cfcc50d7
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
b2f378cc687574fb4d71e3babb1cef7641888366caa6429c4d2de81cc5023777
MD5 hash:
d1c748b4ebabe6bb526f17f3caa5db0a
SHA1 hash:
8e8882121b657f5dfec47cfb5beff9b9f6a22f10
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
fd8c59f2428809de9bd969679f0df182240b3c66aef42094881028667009850c
MD5 hash:
4d0276eb26ec49bcbde5e8318904ec5d
SHA1 hash:
84ca1293f5f19f8b1b394a77aed64187ec8f4528
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
6e0578f54191127eba0f11a910bc427baad0cd25a7a007328a2c2d897771337f
MD5 hash:
2f8fb87ec348a8696a79f34e939d572b
SHA1 hash:
26a2d06bf75683c0b7c09c2fdd96eef0bb0c1e10
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
2c65c8f3bc2a428124ac04a788674683135caa90b8774e7c7aa8ef9fc2cc23ea
MD5 hash:
24c3b6ec40d9cba4f9a740fc1f0e5bff
SHA1 hash:
3a1b1183a2760bd6a8157c06d5a977a8f4475ad0
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
4a986f63e2352820af28f30c620aeb2f5f89ec57916b963627e2b705c10e463a
MD5 hash:
a48fe6352df538f5706097f91de92a5c
SHA1 hash:
0d16737353050e4fbbcf150e7e447520f42aaf4d
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
17c6394f4256e6ec014b98d078dcfae89bfff431bb5fd17e95d5858b50ca1659
MD5 hash:
2927aaa5f942c2fb3f781d0ed30fb6ab
SHA1 hash:
19c566defbc40d60e909cd4635a840a042b119b3
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
bbdac634f0e5db9f31619a74b69d62425d4fd0968ca9c3dd91e0f3a9c7548762
MD5 hash:
a91760ec2e79988cdfc7c85a847ee26c
SHA1 hash:
728575efac51d5094c24d35b03d2ad0b22996dcb
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
462baff68a4877cbbcfb7c1094241a6685aa920fbff202b246070e86405c6ff4
MD5 hash:
5baf87364913639b8c102b7819535082
SHA1 hash:
f107876a9161c80f38ae943ae149e62b9afcc1a7
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
d6fab51bb074a1f2e5e16822958f17df1cb60e2fbff8e999e215ea01501e2b87
MD5 hash:
3a40273b84cf03c839309d765b7a9d9b
SHA1 hash:
1c8eb5c8dbeace98d124154e20c8ef6ced9e1370
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
fbc26f6f2f80914da2bbc29d1145a4ffbb0b0bb44c4d40f8d38ada592424f25a
MD5 hash:
9057bfd926614a8ff06f1a1bbd21d800
SHA1 hash:
ae55d7c923cf0e282ff1e3af51ee05354f1e13ae
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
08eed4c344d2e30872737115dfa824838fbb2b2be8c0a606e71c54597b88aa9c
MD5 hash:
e46727909bfdf657c6e672ade2b396b8
SHA1 hash:
fd839fb30d09859e4492f442b6c7e9f4058bbd26
Detections:
win_socelars_auto
Create hunting rule
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
SH256 hash:
6fd5c640f4c1e434978fdc59a8ec191134b7155217c84845ea6a313aecf25bcc
MD5 hash:
0a509e3ea3c1d1a6a778c6a4fd2f2c8f
SHA1 hash:
e04dc2a139d40b078542f35d18fbf8771f6fb38f
Link:
https://www.unpac.me/results/9967e77b-19f3-4465-9a60-b3c5bdbd9d08/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/6fd5c640f4c1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6fd5c640f4c1e434978fdc59a8ec191134b7155217c84845ea6a313aecf25bcc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/200051/

Comments