MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 951337ef30b8c0940e630f56187954653fb03de3cbc9367e75d68d9432126fa4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs 2 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 951337ef30b8c0940e630f56187954653fb03de3cbc9367e75d68d9432126fa4
SHA3-384 hash: 3ec45ccbf3de949280fd4f6807a5fc7ece2cb7321556aeb729e668696009967d39f409e30649861ba2d7d1a89f558a3f
SHA1 hash: 5a35c5deeec0d1ed7b4b91857539c0a802e68b91
MD5 hash: 2b38356a2ffe12979669044ce1dd2fa2
humanhash: mango-indigo-bulldog-fruit
File name:2b38356a2ffe12979669044ce1dd2fa2.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:218'112 bytes
First seen:2022-05-11 13:26:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:YeQzh+3+VKzS/HlwpFq4PrSpBRAJvJ70jNRIa/YTa8tFmIDz1xIDc:LQk3kqriUxYj0QQu
Threatray 2'151 similar samples on MalwareBazaar
TLSH T1E424F717BB9A11F8F3A69B3494A24502E3767C1A07B196CF8351727F0D623D19E73B28
TrID 65.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
24.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
3.4% (.EXE) Win64 Executable (generic) (10523/12/4)
2.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 8cf6c8d4d4eac48c (1 x Formbook)
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Formbook C2:
206.189.57.91:10950

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
206.189.57.91:10950 https://threatfox.abuse.ch/ioc/549619/
188.166.34.212:8008 https://threatfox.abuse.ch/ioc/549620/

Intelligence

File Origin
# of uploads :
1
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/269701/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader23.12367.12386.9993.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Enabling the 'hidden' option for recently created files
DNS request
Sending a custom TCP request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe dotnet.exe obfuscated packed
Link:
https://www.filescan.io/uploads/627bb9b5b119a5f609bafdb4/reports/6df940b9-7c8c-41b0-992c-14306f87fd14/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b29ab6f-6d34-4b57-852f-9ef6d5fabcf7
Result
Threat name:
AveMaria, LimeRAT, RedLine, Redline Clip
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/991860
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AveMaria stealer
Yara detected Generic Downloader
Yara detected LimeRAT
Yara detected Redline Clipper
Yara detected RedLine Stealer
Yara detected StormKitty Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 624356 Sample: 4BdN4MsOSx.exe Startdate: 11/05/2022 Architecture: WINDOWS Score: 100 96 Snort IDS alert for network traffic 2->96 98 Malicious sample detected (through community Yara rule) 2->98 100 Antivirus detection for URL or domain 2->100 102 19 other signatures 2->102 10 4BdN4MsOSx.exe 6 2->10         started        14 AppStore.exe 3 2->14         started        17 taskshell.exe 2->17         started        19 taskshell.exe 2->19         started        process3 dnsIp4 62 C:\Users\user\AppData\Local\...\conthoste.exe, PE32 10->62 dropped 64 C:\Users\user\AppData\...\4BdN4MsOSx.exe.log, ASCII 10->64 dropped 66 C:\Users\user\...\Universal Imap Tool.exe, PE32+ 10->66 dropped 132 Detected unpacking (overwrites its own PE header) 10->132 134 Hides that the sample has been downloaded from the Internet (zone.identifier) 10->134 21 conthoste.exe 15 6 10->21         started        26 Universal Imap Tool.exe 10->26         started        92 188.114.97.10, 443, 49774 CLOUDFLARENETUS European Union 14->92 94 tacticaltokens.com 14->94 file5 signatures6 process7 dnsIp8 72 tacticaltokens.com 188.114.96.10, 443, 49766, 49773 CLOUDFLARENETUS European Union 21->72 60 C:\Users\user\AppData\...\AppStore.exe, PE32 21->60 dropped 112 Antivirus detection for dropped file 21->112 114 Multi AV Scanner detection for dropped file 21->114 116 Protects its processes via BreakOnTermination flag 21->116 118 4 other signatures 21->118 28 AppStore.exe 17 5 21->28         started        33 schtasks.exe 1 21->33         started        file9 signatures10 process11 dnsIp12 86 188.166.34.212, 49778, 8008 DIGITALOCEAN-ASNUS Netherlands 28->86 88 104.21.73.109, 443, 49776 CLOUDFLARENETUS United States 28->88 90 3 other IPs or domains 28->90 68 C:\Users\user\AppData\...\tmpC19B.tmpdll.exe, PE32 28->68 dropped 136 Protects its processes via BreakOnTermination flag 28->136 35 tmpC19B.tmpdll.exe 7 28->35         started        39 conhost.exe 33->39         started        file13 signatures14 process15 file16 52 C:\Users\user\AppData\Local\...\svchoste.exe, PE32 35->52 dropped 54 C:\Users\user\AppData\Local\...\Terminal.exe, PE32 35->54 dropped 56 C:\Users\user\AppData\Local\Temp\App.exe, PE32 35->56 dropped 58 C:\Users\user\...\tmpC19B.tmpdll.exe.log, ASCII 35->58 dropped 104 Antivirus detection for dropped file 35->104 106 Multi AV Scanner detection for dropped file 35->106 108 Machine Learning detection for dropped file 35->108 110 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->110 41 App.exe 35->41         started        45 Terminal.exe 35->45         started        47 svchoste.exe 35->47         started        signatures17 process18 dnsIp19 74 206.189.57.91, 10950, 49804, 49813 DIGITALOCEAN-ASNUS United States 41->74 76 api.ip.sb 41->76 120 Antivirus detection for dropped file 41->120 122 Multi AV Scanner detection for dropped file 41->122 124 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 41->124 130 3 other signatures 41->130 78 ip-api.com 208.95.112.1, 49796, 80 TUT-ASUS United States 45->78 80 akibanation.com 139.162.9.254, 49798, 80 LINODE-APLinodeLLCUS Netherlands 45->80 82 www.akibanation.com 45->82 126 May check the online IP address of the machine 45->126 128 Machine Learning detection for dropped file 45->128 84 192.168.2.1 unknown unknown 47->84 70 C:\ProgramData\AMD Driver\taskshell.exe, PE32 47->70 dropped 50 taskshell.exe 47->50         started        file20 signatures21 process22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/951337ef30b8c0940e630f56187954653fb03de3cbc9367e75d68d9432126fa4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-08 04:19:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
26 of 41 (63.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sujtp3zqxdajidtdb5lbq6kumu73appdzpetm7tv22gzimqsn6sa._file
Verdict:
malicious
Similar samples:
0e69af9159b216996061639ebb6ab0a2a4ef9e1cf02be2053c9f1b3aabecd9ef
Formbook
387cc2ebbd93f8207e1fbf6ab34434dfb1dc04811d0937174f6251aa6e1cdaa1
Formbook
7d900c842228164a450c070b49db71709f73aab97f548167e79742f505e2edc7
Formbook
8423897de4c0930e7f358bae1b974df4711a3e55ca95e42d1bb36886498ef491
Formbook
8a31c332dfb8714bc0c66300102fa84ee54a4027ed40e2c7082957abb431c34e
Formbook
8b9fd93906cbfe3753c41220bc9ad789d0cc7f279ccb223b7ced9e965a544c52
Formbook
8e8caa79da5237c8973fa2490bfd316a5001e5ed3a5175c9f7d5d2f84cd009f7
Formbook
+ 2'141 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:limerat family:redline infostealer persistence rat suricata
Link:
https://tria.ge/reports/220511-qp3s5sged4/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
LimeRAT
RedLine
RedLine Payload
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Unpacked files
SH256 hash:
756882f4fe12dcbfa27a8ac5872126c55100848c213c228e661e712d967391ab
MD5 hash:
4a2be971a7d2b9fb36dc1e718dbf1887
SHA1 hash:
01bbc35a6e382219be0776789a82264780aa0933
Link:
https://www.unpac.me/results/aa99a725-1423-4211-a183-705e9fce696b/
SH256 hash:
951337ef30b8c0940e630f56187954653fb03de3cbc9367e75d68d9432126fa4
MD5 hash:
2b38356a2ffe12979669044ce1dd2fa2
SHA1 hash:
5a35c5deeec0d1ed7b4b91857539c0a802e68b91
Link:
https://www.unpac.me/results/aa99a725-1423-4211-a183-705e9fce696b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/951337ef30b8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/951337ef30b8c0940e630f56187954653fb03de3cbc9367e75d68d9432126fa4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/269701/

Comments