MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135
SHA3-384 hash: 15d7f23766a2843a91c407c26eecdf3783ed579e6d6a57e6a7dab16ac723670717ec7cbd9574d2bebe233b800af29c5a
SHA1 hash: 14cb4a4e1d5ca4a715a06df641933f7d50cd40b6
MD5 hash: 8dea3dfc88c81629eda9299c7031ed9e
humanhash: illinois-minnesota-stairway-spring
File name:8dea3dfc88c81629eda9299c7031ed9e
Download: download sample
Signature Formbook
Create hunting rule
File size:254'500 bytes
First seen:2022-01-27 13:51:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:owyLaoLb5aZoqSYR8hA5VzVw1NZ8E7+yAFfByFBG4yv:WLBH5auB+4qVzOR17+yzFBGN
TLSH T1FA44122A27D048FBF41F86B105635322E3FCB40976A152574BB65F6F7E12A4B6A33342
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8dea3dfc88c81629eda9299c7031ed9e
Verdict:
Malicious activity
Analysis date:
2022-01-27 22:53:32 UTC
Tags:
installer
Link:
https://app.any.run/tasks/246e9dc3-72ba-4d4b-85ed-3b481cd16fe9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/224341/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61f2a3946a7929f66a1b09f9/reports/dc47e1c0-9923-44e2-84a5-988830bd42f6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/afdfe62e-7ed6-4475-902e-1c47aa7ae077
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/929211
Behaviour
Behavior Graph:
n/a
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-01-27 13:52:10 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:u6vb loader rat
Link:
https://tria.ge/reports/220127-q6e4eadgam/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Unpacked files
SH256 hash:
20dec291b879fbd6ab374ae4d2de71c61dd54d0310db2ce097634f3b3d1d87e5
MD5 hash:
377cb9e3cf3ad38dffecb4ebe948394e
SHA1 hash:
6812ad738f5de09403ad49cc4d5031a16e911a9b
Link:
https://www.unpac.me/results/dc8fcb6e-5d2c-46a3-a31f-d40f02030b1c/
SH256 hash:
4a9316fabebef3467c9229c81238cbbb0bcf784c95de8e1c69b3e7d75ebc0916
MD5 hash:
d4cea9ae27fa5d8fbb99e6bd3f62902a
SHA1 hash:
e3579b380f95afa22f7d60ce23cd3cda3bc94b90
Link:
https://www.unpac.me/results/dc8fcb6e-5d2c-46a3-a31f-d40f02030b1c/
SH256 hash:
b0d45e0fccc6a3fb1fae8472ce0e12a4249b195e5d88ba929b6343724c1d21f1
MD5 hash:
df64038f0057d521bebdc5ff040fe166
SHA1 hash:
82e6250ca82a11005c315f10baed6f10a5b4a436
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/dc8fcb6e-5d2c-46a3-a31f-d40f02030b1c/
Parent samples :
41baa5cad8fb3ecbaa97116421042ba41a024823638e9b7608c5ac2e2a339525
4347405657fb7bd0556c371bc24640368f52d97791e07f14c79f324a1436d925
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376
9f35e751b58fdca3b7156eba1bf2a56c88d3d5ce5e35de6b2797e6c8ba6ec0d8
7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135
aa067750ad705a1b6176cb6f3f91466c9d5c2ee4457c2466b995bef70c04b240
SH256 hash:
7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135
MD5 hash:
8dea3dfc88c81629eda9299c7031ed9e
SHA1 hash:
14cb4a4e1d5ca4a715a06df641933f7d50cd40b6
Link:
https://www.unpac.me/results/dc8fcb6e-5d2c-46a3-a31f-d40f02030b1c/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7bc209b35e0f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2009394/
Cape
Cape
https://www.capesandbox.com/analysis/224341/

Comments


Avatar
zbet commented on 2022-01-27 13:51:44 UTC

url : hxxp://107.174.138.158/200/vbc.exe