MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ef4a2f7e0e66b8b84b3b8a18ad3dee9d559717f27ea2362a361405bdf68c9b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ef4a2f7e0e66b8b84b3b8a18ad3dee9d559717f27ea2362a361405bdf68c9b7
SHA3-384 hash: e2f423aa3aa4e3b20849f4f3f04a24bfcbeac56ad91df00d4075575cdfc013f5386ee2a275683db9a6287acec329dfbd
SHA1 hash: 60ce1ce6b11cd9391457e3f99b9cf49adf40ace0
MD5 hash: 1e14636c18cfcb7959f05816ba86503c
humanhash: sixteen-equal-autumn-bacon
File name:Swift copy payment.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'193'984 bytes
First seen:2022-02-22 14:09:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:VDCGeWcJDZrCPdNlg+WAHcbUeOedx+IEP7DhCnx7V3FGXgRvpdVamKyGfcznwxWk:VD+yTg2qUBedQIatCBV3FIiAA
Threatray 14'158 similar samples on MalwareBazaar
TLSH T1074549D83740B1EEC857C936C9785C61EA21746E8B0F8207A4532AAEAD1D79BCF154F3
File icon (PE):PE icon
dhash icon 6cecccccb4c2f2b2 (38 x AgentTesla, 30 x Formbook, 24 x PythonStealer)
Reporter malwarelabnet
Tags:exe FormBook xloader

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/243272/
Detection(s):
SecuriteInfo.com.Variant.Strictor.265319.21802.23495.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Searching for synchronization primitives
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
hiddentear obfuscated packed strictor
Link:
https://www.filescan.io/uploads/6214eec8a2660f3bb925e1a7/reports/16136102-bd6e-403b-be36-1f118663a605/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b510fe80-bc85-4dfa-9f93-003b8da6b9d3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/944062
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 576557 Sample: Swift copy payment.exe Startdate: 22/02/2022 Architecture: WINDOWS Score: 100 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus detection for URL or domain 2->23 25 8 other signatures 2->25 6 Swift copy payment.exe 3 2->6         started        process3 file4 17 C:\Users\user\...\Swift copy payment.exe.log, ASCII 6->17 dropped 9 Swift copy payment.exe 6->9         started        11 Swift copy payment.exe 6->11         started        13 Swift copy payment.exe 6->13         started        15 2 other processes 6->15 process5
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8ef4a2f7e0e66b8b84b3b8a18ad3dee9d559717f27ea2362a361405bdf68c9b7/
Threat name:
ByteCode-MSIL.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2022-02-22 14:10:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
34
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r32kf57a4zvyxbftxcqyvu665hkvs4l7e7vcgyvdmfafxx3izg3q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0da36b7f7e4b44b640ab5769532fdd7599032ca2b1d6b57807ba48ad1fa76780
Formbook
1771bccdd4c4fdc7d50d97ac10e5b1e0f980a4ff31233c59e9cfa17e9cd36a24
Formbook
2a4415721925c12ce8a80719697ffbda5daf88fe34804b0549bc5d5605790cdb
Formbook
2c68bd37fabbedd352ee351197d915993eb6a7c170733edbaf4272b5d8b7b5c5
Formbook
32fea88907cbefd31749cedfc8b85d3775fca2f65b15594dde355624b3ad7cc8
Formbook
70c6fd4de902c8ccce31380698b123def84b4d209c8b824e1065349a5aee9de2
Formbook
75362f20dab8d57db3ade6427e647b0bc01d8345ccfa9781d5778877f04f7fb5
Formbook
cfd1a77378decd68cd7a59307b77b93247bdd91e00de5111ecae6b5658c8665f
Formbook
e649ef1ecf0e0daefe140fa78271435271c8d55607f8365ddef4d94b66bfdfdd
Formbook
+ 14'148 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:6dmq loader rat suricata
Link:
https://tria.ge/reports/220222-rgqdhsageq/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
4fd8c67e8e7327c3d4c87fc6b3798e2460487ab0ccb95f15215cb194ff0073e2
MD5 hash:
377eb9bca561856eb1ff0840742c52f1
SHA1 hash:
8a1f1787ee2165b57f44deedf4f35d9f195e1d34
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/e0d4a4b8-3dbf-4f88-bdad-151ab4235ef7/
Parent samples :
755519325ba730c3e0ec5cae1d3657e1e42c1327195550c6893dab51179161c9
b5ca813a9176c8f6eb9394308c56858d9e27300f9c5a75c82eceae96b8defd83
8ef4a2f7e0e66b8b84b3b8a18ad3dee9d559717f27ea2362a361405bdf68c9b7
16119a34513a37c16bc130507da88bfb5f90384bab73dc6f8559628416bb583f
e74093d3c119896418879356da45b993f61533689db4a48e6b7501bfda40be78
SH256 hash:
01a9990ddf0a93f1d0b6e3d4db79eefa74f6d04e132660bff80e58b7e620fe47
MD5 hash:
e9f511f0f45119eb667b86280d2c59e2
SHA1 hash:
6efdbcc28d61037539bb95c118fd5f48efc739fe
Link:
https://www.unpac.me/results/e0d4a4b8-3dbf-4f88-bdad-151ab4235ef7/
SH256 hash:
e3bdaf9e98eb65a070cf4424bc123e57ade151c41e4a0d375e769749155c1715
MD5 hash:
78a25e75b94923e889ecd100349facbe
SHA1 hash:
6b3f8db525d3c98f92ed480e664ab8ee9458340b
Link:
https://www.unpac.me/results/e0d4a4b8-3dbf-4f88-bdad-151ab4235ef7/
SH256 hash:
0396870bf1d72dca84f17255e0840f265ebaffc0e7845b181f5fb598a017916e
MD5 hash:
cae2fe2fe45118a036a83f9d709e663d
SHA1 hash:
1d124651bf83f1b531aa157ee266e6f190685235
Link:
https://www.unpac.me/results/e0d4a4b8-3dbf-4f88-bdad-151ab4235ef7/
SH256 hash:
8ef4a2f7e0e66b8b84b3b8a18ad3dee9d559717f27ea2362a361405bdf68c9b7
MD5 hash:
1e14636c18cfcb7959f05816ba86503c
SHA1 hash:
60ce1ce6b11cd9391457e3f99b9cf49adf40ace0
Link:
https://www.unpac.me/results/e0d4a4b8-3dbf-4f88-bdad-151ab4235ef7/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8ef4a2f7e0e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ef4a2f7e0e66b8b84b3b8a18ad3dee9d559717f27ea2362a361405bdf68c9b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/243272/

Comments