MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd
SHA3-384 hash: a3ad8890f87ba8dbd45ed2894d81fa00cff323328b452586ea6eabbffbc1f2a97db970859c0a65a14c8841c9ab821959
SHA1 hash: 5354a0047e2a26e0e7829ece3ba223478c490dda
MD5 hash: 02eebb83231ac8e4ec8ced427b7a64a4
humanhash: bakerloo-mexico-helium-ink
File name:6rR1G3EcvT3djII.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:509'440 bytes
First seen:2020-12-08 14:30:49 UTC
Last seen:2020-12-08 17:08:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:4jeQyPoJ3lJfXUxWDN8XiqsWgn1zJe3LjVkDnzD:pzAJf2WZ8sWg1zWK
Threatray 3'085 similar samples on MalwareBazaar
TLSH 6BB402321242AFAFD76A1FBB860421158EB4F427BA17F79CBEC050C505E27948D95AF3
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6rR1G3EcvT3djII.exe
Verdict:
Malicious activity
Analysis date:
2020-12-08 14:48:07 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/f9f96d18-b30e-4b44-aa18-db49081c78b0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/107260/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.6136.29595.19233.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/557985
Signature
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 328091 Sample: 6rR1G3EcvT3djII.exe Startdate: 08/12/2020 Architecture: WINDOWS Score: 100 32 g.msn.com 2->32 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected AntiVM_3 2->48 50 2 other signatures 2->50 11 6rR1G3EcvT3djII.exe 3 2->11         started        signatures3 process4 file5 30 C:\Users\user\...\6rR1G3EcvT3djII.exe.log, ASCII 11->30 dropped 62 Tries to detect virtualization through RDTSC time measurements 11->62 64 Injects a PE file into a foreign processes 11->64 15 6rR1G3EcvT3djII.exe 11->15         started        signatures6 process7 signatures8 66 Modifies the context of a thread in another process (thread injection) 15->66 68 Maps a DLL or memory area into another process 15->68 70 Sample uses process hollowing technique 15->70 72 Queues an APC in another process (thread injection) 15->72 18 explorer.exe 15->18 injected process9 dnsIp10 34 ebaysuspensions.com 50.87.253.203, 49755, 80 UNIFIEDLAYER-AS-1US United States 18->34 36 flourishotuedon.com 51.79.78.181, 49753, 49770, 80 OVHFR Canada 18->36 38 25 other IPs or domains 18->38 52 System process connects to network (likely due to code injection or exploit) 18->52 22 wscript.exe 12 18->22         started        signatures11 process12 dnsIp13 40 www.colorsplash.xyz 22->40 42 colorsplash.xyz 22->42 54 System process connects to network (likely due to code injection or exploit) 22->54 56 Modifies the context of a thread in another process (thread injection) 22->56 58 Maps a DLL or memory area into another process 22->58 60 Tries to detect virtualization through RDTSC time measurements 22->60 26 cmd.exe 1 22->26         started        signatures14 process15 process16 28 conhost.exe 26->28         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 14:30:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sftmvkebr5gmmkwhsiwzahjznyl4b7yim7ci2uv5renqkeq2xl6q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
17c7eb5988e11440ac66fccc2a9c8ada3ab1e7183480ddd05ee3a47b19a95f9b
Formbook
2664162d0341d8e5cf1cf3a290b77406d87111e3c9ff3fcf3a4f0836d15d3afe
Formbook
2919a5d96ade5e0f2967d98a7b49b1f612435ed6a6b3843424a8c1e99ea0e9ab
Formbook
2bda7325843b48687e064e2abeeef3f5eae5865fceccbbb0ad5229fcf624bf40
Formbook
6d923f02c2252e4a2ea98a8685fc5237354e2853791855f1a451a390dd85cbb9
Formbook
7e43a881578a70074b8cd80b8dca635ba19180923833a32638dfbd5767216dee
Formbook
cf881c52980129f685da1dee4674018fa0fc1db346565dd917ae0160ce26b25d
Formbook
e04ac8ec3e13e60c17c1ab13acb486e2e60877e44b6a3ee8a9e372a45d0c8e42
Formbook
e78b5071209858cdcb5ce02f7df3c3fb857088f7088b964791d289c789451e67
Formbook
edb4639fe2eeb567856790fc73f716baeea57ab54fc91e31f49309009978de55
Formbook
+ 3'075 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader loader rat spyware stealer trojan
Link:
https://tria.ge/reports/201208-efee1fc7cs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Formbook
Xloader
Malware Config
C2 Extraction:
http://www.foundyourhuman.info/onga/
Unpacked files
SH256 hash:
9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd
MD5 hash:
02eebb83231ac8e4ec8ced427b7a64a4
SHA1 hash:
5354a0047e2a26e0e7829ece3ba223478c490dda
Link:
https://www.unpac.me/results/e91a71f2-d850-4b2a-8ec5-48630a7e7ef2/
SH256 hash:
c88a66cbf00b12c88e2b970b8bc220e970e8465e56098ced24e97d42be901b94
MD5 hash:
a60401dc02ff4f3250a749965097e13f
SHA1 hash:
3f22d28fd765f831084cb972a8bd071e421c26a1
Link:
https://www.unpac.me/results/e91a71f2-d850-4b2a-8ec5-48630a7e7ef2/
SH256 hash:
abfe6f14858d58ee069b9638e1b35a269db107f69cbb1c37958dbfcbba2e5167
MD5 hash:
e1b795cbcba590e9b16ac7bfc757ecb8
SHA1 hash:
d0a2f36e84f9e63ce5b57351f5babdcde93fb8d1
Link:
https://www.unpac.me/results/e91a71f2-d850-4b2a-8ec5-48630a7e7ef2/
SH256 hash:
1997bbd7f0f92e354a95b71fc2c885c7f209d4b4ed24cea0c42c45bfe23be417
MD5 hash:
1761b472500bf20d34aed9cc0997382e
SHA1 hash:
8611f9e9981d9660c46c0fe6a65a3f6f62607915
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/e91a71f2-d850-4b2a-8ec5-48630a7e7ef2/
Parent samples :
9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd
80647f6b0ee0d8b14ba78bbd6cbfdf6e332692af7eb0f3348fc76facc4ad23ef
f1c600a86d9492512f5c80574f885bc0b2c0f058419f58b1c8800eb6e1502713
144e3b521adb2f66b50fd33944e006ed93078559a0469ef44efad381d4865555
1a2c749fb299acc704d2744fa47b02d2ccc4f9a461be0d5ebaa829824e5fb329
2ce70c12c5b8806fc6b3e507c5ed406599045b20688b456db124b1b685da60d0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Reversed_Base64_Encoded_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an base64 encoded executable with reversed characters
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/107260/
  
URLhaus
https://urlhaus.abuse.ch/url/899429/

Comments