MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a
SHA3-384 hash:	1bdbe2ee0fac90d9df30f9732d093c34c885e38bd4986fbc26b0362d0708d6d0c9a08b149a30bd0b186f4d2a2c6da752
SHA1 hash:	7a832f868d9f933674b5b74c592c0886adf43e89
MD5 hash:	68a079650a21b73805aa34b35882f56d
humanhash:	batman-fish-ceiling-violet
File name:	SecuriteInfo.com.W32.AIDetectNet.01.16119.3116
Download:	download sample
Signature	Formbook Create hunting rule
File size:	460'288 bytes
First seen:	2022-06-13 16:49:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	6144:60TlRBaf4cIJQupaQwVr6vamQzf1+ya+kubHycyFDvMuRtlNXNJuc72FlIxC/anf:607BafvI/atr6BXFdubHycyFDdnBnZ
TLSH	T13FA41242B6FA0A69F93D4B7407A280005377369B297FE65CDC1D70EE0636F899392B13
TrID	64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	SecuriteInfoCom
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

287

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.W32.AIDetectNet.01.16119.3116

Verdict:

Malicious activity

Analysis date:

2022-06-13 17:07:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cfe0e4e6-d2ee-4c5c-8aa0-c15ca6f3bc1a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/279482/

Detection(s):

SecuriteInfo.com.W32.AIDetectNet.01.16119.3116.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Сreating synchronization primitives

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62a76abf8763ffd4adbf99b0/reports/e0f6de89-23b0-4331-b59c-fc028485c6f8/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b9b46f88-29de-4fc4-9017-f7da7de40dab

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1012243

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

xloader

Link:

https://mwdb.cert.pl/sample/9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a/

Threat name:

ByteCode-MSIL.Trojan.RealProtect

Status:

Malicious

First seen:

2022-06-13 16:50:11 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=soclhrn2a7rcy2nau2a4wfhzryxy2atuqwhcvujdohiabscevnfa._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

xloader

Score:

10/10

Tags:

family:xloader campaign:oecd loader rat

Link:

https://tria.ge/reports/220613-vb9fzshddm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Xloader Payload

Xloader

Unpacked files

SH256 hash:

2d3fe4fbd1cd25c88cdb083e5010cf6aee96ce6de295eed1264363aeb0eef2af

MD5 hash:

6e01207eed50db59483dbf40f29dab55

SHA1 hash:

a161c5b8aa03b448df1a0c38865b50394d2dc1fc

Link:

https://www.unpac.me/results/97214ab2-bfe6-4fcf-bc12-16c650a04e6c/

SH256 hash:

dec15271d422cf3b82c0a94cf147312bb5a4a4f262da4b698ffe7e6bdaf18053

MD5 hash:

79c5c39e29ebe233cd13a50987e64609

SHA1 hash:

0560314716e6519158009159c017d2b52116608e

Link:

https://www.unpac.me/results/97214ab2-bfe6-4fcf-bc12-16c650a04e6c/

SH256 hash:

9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a

MD5 hash:

68a079650a21b73805aa34b35882f56d

SHA1 hash:

7a832f868d9f933674b5b74c592c0886adf43e89

Link:

https://www.unpac.me/results/97214ab2-bfe6-4fcf-bc12-16c650a04e6c/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9384b3c5ba07/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.