MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 705e75a30a579727ae0ca9ab3c7bd40097dc3467c29e7c3208a51c4009742be3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 705e75a30a579727ae0ca9ab3c7bd40097dc3467c29e7c3208a51c4009742be3
SHA3-384 hash: 00e3b4af79609c9991788055d835d8a27829273d21fb5053d5fd9be86dd721ac8ed2c75b15ff9a8da93d45eb4a4299f5
SHA1 hash: 8d8f01df070d5d9cc6c266d235fa4f8e4385b7d0
MD5 hash: ecce2c5c0b5e52edcf5a9d283b767201
humanhash: beryllium-diet-artist-fillet
File name:ecce2c5c0b5e52edcf5a9d283b767201
Download: download sample
Signature Formbook
Create hunting rule
File size:778'752 bytes
First seen:2021-06-21 07:38:03 UTC
Last seen:2021-06-21 10:39:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:Y8YVhhlm4S4F3M9yPfHp+qQdSkhJJbidT0/4NnUyCime1VsY+XnFfCjkENHO+eKi:rYxWyfHUqQdX+dTu4+y6jbaDwK
Threatray 6'033 similar samples on MalwareBazaar
TLSH C7F49E2027E95719F13BAF7946D47545EBFAFA17B312D45D3CA001CB0A12E42CEA2B36
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ecce2c5c0b5e52edcf5a9d283b767201
Verdict:
Suspicious activity
Analysis date:
2021-06-21 07:42:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2aef31f1-5e1c-4981-8a23-ea127da68405

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Bulz.526633.6476.1548.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/22d9b3c1-ff1f-4e82-a365-a8423c5a5405
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/805160
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 437570 Sample: ZSu9Xi5VWW Startdate: 21/06/2021 Architecture: WINDOWS Score: 100 29 www.biztekno.com 2->29 31 biztekno.com 2->31 49 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 7 other signatures 2->55 9 ZSu9Xi5VWW.exe 3 2->9         started        13 explorer.exe 2->13         started        signatures3 process4 dnsIp5 27 C:\Users\user\AppData\...\ZSu9Xi5VWW.exe.log, ASCII 9->27 dropped 57 Tries to detect virtualization through RDTSC time measurements 9->57 59 Injects a PE file into a foreign processes 9->59 16 ZSu9Xi5VWW.exe 9->16         started        33 www.ruhexuangou.com 23.82.57.32, 49749, 80 LEASEWEB-USA-SFO-12US United States 13->33 35 www.myfavbutik.com 172.67.161.4, 49751, 80 CLOUDFLARENETUS United States 13->35 37 11 other IPs or domains 13->37 61 System process connects to network (likely due to code injection or exploit) 13->61 63 Performs DNS queries to domains with low reputation 13->63 19 raserver.exe 13->19         started        21 autochk.exe 13->21         started        file6 signatures7 process8 signatures9 39 Modifies the context of a thread in another process (thread injection) 16->39 41 Maps a DLL or memory area into another process 16->41 43 Sample uses process hollowing technique 16->43 45 Queues an APC in another process (thread injection) 16->45 47 Tries to detect virtualization through RDTSC time measurements 19->47 23 cmd.exe 1 19->23         started        process10 process11 25 conhost.exe 23->25         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/705e75a30a579727ae0ca9ab3c7bd40097dc3467c29e7c3208a51c4009742be3/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-21 00:38:48 UTC
AV detection:
25 of 46 (54.35%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
161ce90a5dbcb52a305aec3d3372c4a35880a7626d0b4e4c927558d4ebae010a
Formbook
196b6069472a478c158cae56200e7d627d7e6b32ab1f361a36b75234bbf998de
Formbook
2e5709f12673cffcf4d3f5109303de822626c3a2a608f9c78a853c0c6d58edd1
Formbook
5b7770f02c562dffdbe0cd638e288adba8f340c7231ef30fa2860b7f4b9dfa80
Formbook
7c8eea0e649a176edb83fc19998f0e99be49c7bee1ff9090d1be69f614554088
Formbook
7fe8fc25255d0fbe221579b985327bb67bb1226f39dfc71b8b59e6a2b15fff11
Formbook
8fb2a899e6622a2ddc7989121174bea2b7756f3f56f64f42dc6ef875d19ce919
Formbook
9f320c52479e05b96faa714826a7671787abf4c4eb33f8aa415b66d1551996ce
Formbook
b736f06a6b82ce1a53ccf2f50cf4d73c24c00750778bebe152dcf3c1956671f9
Formbook
e1339c4548f73e4f250fed46d56bbce84491ca122aed7527731bb8d72df83e11
Formbook
+ 6'023 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210621-1bkfykrwp2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.adultpeace.com/p2io/
Unpacked files
SH256 hash:
bed73f7ba948bf6c9f8280d1bc8e48f34b5c9fe62bdb0d393c9138fe12701832
MD5 hash:
d220b7de35e659ace210796f7326d760
SHA1 hash:
17959784fe5beb6f75b959a79229a34ca0ae4762
Link:
https://www.unpac.me/results/f8478162-0bae-4a26-bb6b-719e5bdb72a7/
SH256 hash:
705e75a30a579727ae0ca9ab3c7bd40097dc3467c29e7c3208a51c4009742be3
MD5 hash:
ecce2c5c0b5e52edcf5a9d283b767201
SHA1 hash:
8d8f01df070d5d9cc6c266d235fa4f8e4385b7d0
Link:
https://www.unpac.me/results/f8478162-0bae-4a26-bb6b-719e5bdb72a7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/705e75a30a579727ae0ca9ab3c7bd40097dc3467c29e7c3208a51c4009742be3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 705e75a30a579727ae0ca9ab3c7bd40097dc3467c29e7c3208a51c4009742be3

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1384463/

Comments