MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 925d0c4c1be3ff3e6157f61ddbdfd7eca48c25157c219b9fa33286e75251efe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 925d0c4c1be3ff3e6157f61ddbdfd7eca48c25157c219b9fa33286e75251efe2
SHA3-384 hash: cb530ecae12d01206abee808cdfee09337e72e2c017d7cc0dfe019339df41d9dbf0273de48207f35bc344644c4ac8d77
SHA1 hash: 29dfd072dc1fbbc7d1849c89ac4358de063fd8ab
MD5 hash: 332069bac78cd3787fb6c009645c46a9
humanhash: queen-twelve-failed-zebra
File name:332069bac78cd3787fb6c009645c46a9.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:953'344 bytes
First seen:2021-07-28 18:18:49 UTC
Last seen:2021-07-28 18:58:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:fB+Srpy1jlY8WSh07iS/d348yoBoRoDoyooN8130uTvK9hJzDutHIcIRrOfDxJrH:/mY8DS/d3YK64JU1kaQhdDKocIEF
Threatray 6'525 similar samples on MalwareBazaar
TLSH T1B415AF3856D8969FF9EF073D0BD820B0EBF4E112317193A91ED101B959A6F64CCB42A7
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
332069bac78cd3787fb6c009645c46a9.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-28 18:26:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4f082085-0f2d-42b1-92bd-bb4fe0a01921

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/174794/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.EXY.genEldorado.28260.3329.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9aaf65b8-3ace-4b01-9ff4-e318691b3d07
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/823300
Signature
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 455712 Sample: WKW8LwbqvX.exe Startdate: 28/07/2021 Architecture: WINDOWS Score: 100 31 www.pamm4fx.com 2->31 33 www.sxjfdq.com 2->33 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 4 other signatures 2->43 11 WKW8LwbqvX.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\WKW8LwbqvX.exe.log, ASCII 11->29 dropped 53 Tries to detect virtualization through RDTSC time measurements 11->53 55 Injects a PE file into a foreign processes 11->55 15 WKW8LwbqvX.exe 11->15         started        signatures6 process7 signatures8 57 Modifies the context of a thread in another process (thread injection) 15->57 59 Maps a DLL or memory area into another process 15->59 61 Sample uses process hollowing technique 15->61 63 Queues an APC in another process (thread injection) 15->63 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.pamm4fx.com 107.148.46.141, 80 PEGTECHINCUS United States 18->35 45 System process connects to network (likely due to code injection or exploit) 18->45 22 chkdsk.exe 18->22         started        signatures11 process12 signatures13 47 Modifies the context of a thread in another process (thread injection) 22->47 49 Maps a DLL or memory area into another process 22->49 51 Tries to detect virtualization through RDTSC time measurements 22->51 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-28 16:23:13 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sjoqyta34p7t4ykx6yo5xx6x5ssiyjivpqqzxh5dgkdoousr57ra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1086e2faa19287c271b669be3118a0509f3547cbe638e7f783d0c691be084be8
Formbook
19f2101d500dfa2ba71baf220497fe8888667bb7d9c8cf4996087ff67c11d156
Formbook
1a9057facef9978ff272da6ac0e4018aa27dacb0c878d03b84cb9d3bc1d89b9b
Formbook
1b9311365ac0c371e7e3656d8d9074a654bfff4677e074f754e5053bca200298
Formbook
89fd73d17d825a1e661f69b41ffd9fcd9f5a3d044159763cbc82ffd0210eb78a
Formbook
8a403d5866d98e6da02683d365c982c0089b338f92d2e2fe7b5ae099dbaa635b
Formbook
abb1db77386f0eb3cd2c68603ee8817d6d1015287422182845345dad70503564
Formbook
+ 6'515 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210728-yd5qwt3zh2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
CustAttr .NET packer
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.gupiao888.club/ons5/
Unpacked files
SH256 hash:
3573d6ffcfc2021bfe0e6ff5130a102aabb20817b0c2f15e65d7c1161acd37c9
MD5 hash:
ba8bdfdac166b8268e836669aa0219c4
SHA1 hash:
4dff36b7c115b932c77b8cd07d4e49dc0e236c94
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/de8c7536-2c3b-4330-8c2b-4467714e10db/
Parent samples :
1a9057facef9978ff272da6ac0e4018aa27dacb0c878d03b84cb9d3bc1d89b9b
925d0c4c1be3ff3e6157f61ddbdfd7eca48c25157c219b9fa33286e75251efe2
57bcc23142e7398ee53fd5e374851444f18857c4d9f7e23daf4435692b6ba2dd
SH256 hash:
287aa48c23cdaf0b5da022811abe36b16ee36d3d4402ed38200f681cee6c1ce3
MD5 hash:
6d8b9ff663eba445a2ee8be8bfa631b8
SHA1 hash:
cf5dd4d31bba07f7df6aa767f88a04d919af73c3
Link:
https://www.unpac.me/results/de8c7536-2c3b-4330-8c2b-4467714e10db/
SH256 hash:
9ede9492b1317bf5d9a03789bc4867c253ab32cdcf6e1398dbd57285fab1553d
MD5 hash:
4c0c64b93f6aa281bdd27509d9b8cf57
SHA1 hash:
8e530111c57ccacf18c028e0fe83b306efbdf4d7
Link:
https://www.unpac.me/results/de8c7536-2c3b-4330-8c2b-4467714e10db/
SH256 hash:
97d2fa1d01b2f9a2199896e05e0cf60c14a9f41ef2d72e15fbb862b7afa08438
MD5 hash:
68463851c0e6fe7a254c99fae763d454
SHA1 hash:
4587a5371d88c296a0184fe47ee0c5245b187127
Link:
https://www.unpac.me/results/de8c7536-2c3b-4330-8c2b-4467714e10db/
SH256 hash:
925d0c4c1be3ff3e6157f61ddbdfd7eca48c25157c219b9fa33286e75251efe2
MD5 hash:
332069bac78cd3787fb6c009645c46a9
SHA1 hash:
29dfd072dc1fbbc7d1849c89ac4358de063fd8ab
Link:
https://www.unpac.me/results/de8c7536-2c3b-4330-8c2b-4467714e10db/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/925d0c4c1be3ff3e6157f61ddbdfd7eca48c25157c219b9fa33286e75251efe2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 925d0c4c1be3ff3e6157f61ddbdfd7eca48c25157c219b9fa33286e75251efe2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1487558/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/174794/

Comments