MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8590ed565f8e910b38ca91f89df8dc73bd6fec5eabb2b6964f70b4ad586f801e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 11

Intelligence 11 IOCs YARA 3 File information Comments 1

SHA256 hash:	8590ed565f8e910b38ca91f89df8dc73bd6fec5eabb2b6964f70b4ad586f801e
SHA3-384 hash:	5a6d3255300670ffff4381525d18d2c483d6da4374bd6e4eea668290cf5f2d456b029798dfe0964fcbbc53c7c28a563b
SHA1 hash:	01659988acfe38e96524c811baf46ec9bc5bfd53
MD5 hash:	050d0ab9dc5109373a6b450c158e9f9a
humanhash:	uncle-fruit-happy-mobile
File name:	050d0ab9dc5109373a6b450c158e9f9a
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'031'168 bytes
First seen:	2021-12-08 16:38:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	24576:yBe/L/U+xpxsS9HnpvMPH11EjvumBwiZRuuHQiqXfqdibL:ys/VvuS9HSf11Ej2mBnru2QiqXCdibL
Threatray	12'156 similar samples on MalwareBazaar
TLSH	T11A25239AF657EC25D23B6933ECFE505043BCB80A2C12D33A3DF462BC569376984A046D
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

050d0ab9dc5109373a6b450c158e9f9a

Verdict:

Malicious activity

Analysis date:

2021-12-08 16:46:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/78a21b76-c8a6-47b6-8916-d6c9d9c3610a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/212565/

Detection(s):

SecuriteInfo.com.MSIL.Packed.19.25755.8722.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

DNS request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/61b0dfa947ed217c0135f910/reports/73542cc9-28fe-4b78-ae7d-bcfcd7576c72/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7bbbe24a-72f3-4aaf-ba8f-fd2e530d8c9f

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/904027

Signature

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Self deletion via cmd delete

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8590ed565f8e910b38ca91f89df8dc73bd6fec5eabb2b6964f70b4ad586f801e/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-12-08 16:39:13 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 27 (77.78%)

Threat level:

5/5

Verdict:

malicious

Label(s):

formbook

Formbook

3662913e3004f6e3811499a9877265b55fd4b99400607d2f4b4168dc2621f1ab

Formbook

60f3b28c265ee86ff2fda42a3147348bf53971060d9b97e2cd631a32f80ee0cd

Formbook

7ee0cbf586de414cfbbc5bd0d4ccd15934dac266751418154903681805234ddb

Formbook

8a13ce3da212f3557c8d3f43a375fa6e030b400c2da2ca9701bed88f839863fc

Formbook

9b9e383f7635be680129b113ad1e827c61e2e2cf1ce7ccccd2f09b9a0a546494

Formbook

9fa1cc5263270e7856695780225b4084962371dac2f5d7a921d782dc862f0d05

Formbook

c25895e0fbdc51816a728ab69ee1173fda907bd04f3b912d1fb4475d9561ffc9

Formbook

c6043c3c87526712c251385dacc61e443647d1dcca1e86ce411e69cb711c4640

Formbook

dfa895fe8d8da53e7f3c0466a7e88aa5d36f1a781675d03b0c7400847a0b4f6b

Formbook

+ 12'146 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:9g6m rat spyware stealer trojan

Link:

https://tria.ge/reports/211208-t5yqxahfdr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.solkitties.art/9g6m/

Unpacked files

SH256 hash:

b4cf5e9930af610200ee8e273d881ed8f30f269469a8bd0d25b9f0becbc1a218

MD5 hash:

6eef8161fe427a79728e24e6bb5ec877

SHA1 hash:

1cb8a2c12068475115561ffe298fbd1b0a578f84

Detections:

win_formbook_g0

win_formbook_auto

Link:

https://www.unpac.me/results/c75a0aff-6238-4cdb-bdd6-c07603073433/

Parent samples :

8590ed565f8e910b38ca91f89df8dc73bd6fec5eabb2b6964f70b4ad586f801e
baa6c0d95345936cfa15289e60aebd590fcea005d546d40e6e6933657508a277
2d69ba81e9f99d3c2b8998d98160bd087cb3f70203761a58255fbee3c7919a06
d88ceed41b733547f614837d8b9c3967aefa9a81b8afb869e35657288650ef54
8f454860eb8461e6febf3a1977cc7a53733dd72960fec1a41d17ab4e03af6f0d
268f31549715ba5100a49d8b7dd4858118e864c44e153d40d6dec3cdbb223336
101477ca4a93dd39fc6c14ae5f278753bdd78a2eba5b30b63e8bcd2b9c49bab5

SH256 hash:

9cd82dba6c55d901ac7d7007b7a04a30146ad7c297400d44f9d96b90c5ca25d4

MD5 hash:

d9477c36da677507cd33c6eef325d694

SHA1 hash:

330dc88b5041ca9edf57542f5a30c37eef6f11b1

Link:

https://www.unpac.me/results/c75a0aff-6238-4cdb-bdd6-c07603073433/

SH256 hash:

228a43a0f1939f0773299507047e44cc95bcd8b6df844a4cf7da2178fad39c94

MD5 hash:

345e68e0da1fe15e9123e605781cdbf1

SHA1 hash:

115e7e5ef87b0e1580cea3b4eb877986c760bb13

Link:

https://www.unpac.me/results/c75a0aff-6238-4cdb-bdd6-c07603073433/

SH256 hash:

8590ed565f8e910b38ca91f89df8dc73bd6fec5eabb2b6964f70b4ad586f801e

MD5 hash:

050d0ab9dc5109373a6b450c158e9f9a

SHA1 hash:

01659988acfe38e96524c811baf46ec9bc5bfd53

Link:

https://www.unpac.me/results/c75a0aff-6238-4cdb-bdd6-c07603073433/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/8590ed565f8e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.54

Link:

https://yomi.yoroi.company/submissions/8590ed565f8e910b38ca91f89df8dc73bd6fec5eabb2b6964f70b4ad586f801e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

exe 8590ed565f8e910b38ca91f89df8dc73bd6fec5eabb2b6964f70b4ad586f801e

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1866156/

Cape

https://www.capesandbox.com/analysis/212565/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-12-08 16:38:47 UTC

url : hxxp://198.46.199.153/30023/VBC.exe