MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7811bd14cb7fe9de30afeb44ca4d2f009e0e5f0488ad07f282ad0327b4ecd0b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | 7811bd14cb7fe9de30afeb44ca4d2f009e0e5f0488ad07f282ad0327b4ecd0b5 |
|---|---|
| SHA3-384 hash: | 3ef1729a4c065013baee440fed2d79ca75052e8922643960012f646c7481bd78d572479001097810d7a3157362c27ec9 |
| SHA1 hash: | 2b327374dfb4e49ba276598c27be4d6d4cba2d2a |
| MD5 hash: | 93f117ea1f6e392f15d38b9968b3ce74 |
| humanhash: | fifteen-neptune-bulldog-early |
| File name: | 2T65434568--9876543457890-87654.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 346'456 bytes |
| First seen: | 2021-09-20 11:04:30 UTC |
| Last seen: | 2021-09-20 11:51:55 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger) |
| ssdeep | 6144:78LxBAz+3meeKNf59pCoappIO+QUUM+lFLGeeWFS7bvI2TGWJkvLDXT:mmeeKr95yO6zDWI2TGkkT |
| Threatray | 9'514 similar samples on MalwareBazaar |
| TLSH | T13974BFC67BB05852DE04D63DC32E6F15A92B2F746BE0A10BD6417873ABF36CD0817A25 |
| File icon (PE): |  |
| dhash icon | 8b13396969336921 (9 x Formbook, 7 x AgentTesla, 4 x SnakeKeylogger) |
| Reporter |  GovCERT_CH |
| Tags: | exe FormBook xloader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2T65434568--9876543457890-87654.exe
Verdict:
Malicious activity
Analysis date:
2021-09-20 11:06:15 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.LokiBot
Status:
Malicious
First seen:
2021-09-20 11:05:08 UTC
AV detection:
16 of 45 (35.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 9'504 additional samples on MalwareBazaar
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:di4c loader rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.dropadsmedia.com/di4c/
Unpacked files
SH256 hash:
fc195d09ce60ed75d7d6b58b9d750fee17c9f81bb2e22161dc46646dd582a1fb
MD5 hash:
0b27829e2ff4f71f9b99262d83ee90d4
SHA1 hash:
a084ea6e9f28dac20d44d8114426e339b947798c
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
77ac88700f073d795ea0471110387159e6085f020ddfd01704ba578fc2f22590
MD5 hash:
d19b585f76ec02639363803c83d19cc7
SHA1 hash:
b54e0a76b3d521b237014a90479ec18e9ab0ead9
SH256 hash:
7811bd14cb7fe9de30afeb44ca4d2f009e0e5f0488ad07f282ad0327b4ecd0b5
MD5 hash:
93f117ea1f6e392f15d38b9968b3ce74
SHA1 hash:
2b327374dfb4e49ba276598c27be4d6d4cba2d2a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Dropped by
xloader
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.