MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a0fb297baf6f3affb73e0c20116dec0bbbae0292fcbffc3948051555df5099d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 14

Intelligence 14 IOCs YARA 3 File information Comments 1

SHA256 hash:	8a0fb297baf6f3affb73e0c20116dec0bbbae0292fcbffc3948051555df5099d
SHA3-384 hash:	5bb80d7b582b22cf7b5608d4e9824d069545c07c299f5cf543905eae2ad35e0ad9ce5d0c4d4355e93a904b0d3315359e
SHA1 hash:	35dca95d10a31fe0b1832f43005c0a79a6854604
MD5 hash:	5d10c77689e0c3bea850fa3c9ef40e8c
humanhash:	pizza-oklahoma-bacon-connecticut
File name:	5d10c77689e0c3bea850fa3c9ef40e8c
Download:	download sample
Signature	Formbook Create hunting rule
File size:	528'575 bytes
First seen:	2021-12-06 11:54:02 UTC
Last seen:	2021-12-06 13:53:56 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep	6144:wGiztEIOcZis3bJTEppPWz1xJ1AuSwDZOQIPYnXq8gYg+xhWXvgB1Zd4PU2u:ybsmFTsU1xJztZ3m6gmL441ZdoPu
TLSH	T1DDB4018A6068542ACAD4713EAFB0DEF953B09DCD180556771FF47E9B3AFD09712023A2
File icon (PE):
dhash icon	0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

161

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5d10c77689e0c3bea850fa3c9ef40e8c

Verdict:

Malicious activity

Analysis date:

2021-12-06 12:15:46 UTC

Tags:

installer

Link:

https://app.any.run/tasks/eb15db42-c236-49a3-91e1-04c85d82bd2d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/211755/

Detection(s):

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.24704.2746.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a file

Unauthorized injection to a recently created process

DNS request

Sending a custom TCP request

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/1080/overview

Verdict:

Suspicious

Threat level:

5/10

Confidence:

60%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/61adf9dbfa72c81b5b0e4dfd/reports/9be6beb8-145e-4449-bfa4-571a8a3dd469/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c1400fab-4066-4667-b878-b45d6af60d76

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/902236

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Self deletion via cmd delete

Sigma detected: CMSTP Execution Process Creation

Tries to detect virtualization through RDTSC time measurements

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/8a0fb297baf6f3affb73e0c20116dec0bbbae0292fcbffc3948051555df5099d/

Threat name:

Win32.Trojan.LokiBot

Status:

Malicious

First seen:

2021-12-06 09:31:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

xloader

Score:

10/10

Tags:

family:xloader campaign:ea0r loader rat

Link:

https://tria.ge/reports/211206-n2wjgsdhgq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Loads dropped DLL

Xloader Payload

Xloader

Malware Config

C2 Extraction:

http://www.asiapubz-hk.com/ea0r/

Unpacked files

SH256 hash:

8a0fb297baf6f3affb73e0c20116dec0bbbae0292fcbffc3948051555df5099d

MD5 hash:

5d10c77689e0c3bea850fa3c9ef40e8c

SHA1 hash:

35dca95d10a31fe0b1832f43005c0a79a6854604

Link:

https://www.unpac.me/results/25e7b207-3ece-416b-8bf8-fe75597c9477/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/8a0fb297baf6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.33

Link:

https://yomi.yoroi.company/submissions/8a0fb297baf6f3affb73e0c20116dec0bbbae0292fcbffc3948051555df5099d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time