MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96a54086e0d1667ed27dacd61ce88129d2ae1236718babe4ee5b3054385cc215. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96a54086e0d1667ed27dacd61ce88129d2ae1236718babe4ee5b3054385cc215
SHA3-384 hash: 15724ea3f6672f07ca8ba7d59b240a5fb6d674936c8e50ffa1f8cbfcf211c8abbc4fed21c24058dc0a3172e9eb66c508
SHA1 hash: 792b723347fdfc886d1d8a365d1031bb83de451a
MD5 hash: b8af003d11b6ffd7a6dddd4fcf35bf3c
humanhash: tennis-michigan-victor-illinois
File name:b8af003d11b6ffd7a6dddd4fcf35bf3c.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'195'008 bytes
First seen:2021-10-08 11:51:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c7742f6c154c117ccc5799912fd8bda5 (4 x Formbook, 2 x RemcosRAT, 1 x AveMariaRAT)
ssdeep 12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6Hqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXA/mPTY/Jke
Threatray 10'080 similar samples on MalwareBazaar
TLSH T1FA456BCAE992BC7ED3721A382C376354AE2AB93069B855D677EC0C584F3170136ED247
File icon (PE):PE icon
dhash icon e4f0d0d0f0d4d4e8 (9 x Formbook, 4 x RemcosRAT, 2 x ModiLoader)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b8af003d11b6ffd7a6dddd4fcf35bf3c.exe
Verdict:
Malicious activity
Analysis date:
2021-10-08 11:54:42 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/85c211be-6239-4dbb-8ada-304beffe54cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196139/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader43.38297.18775.30697.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/616030ef98a6280f393479c4/reports/3b7690e9-893b-4911-a8ba-1d52f1367f39/overview
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/867044
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96a54086e0d1667ed27dacd61ce88129d2ae1236718babe4ee5b3054385cc215/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-10-08 11:52:16 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
26506e7d3f4821066fc1989a5c79afb4d1a316aa428f9e4a920644d93a80b495
Formbook
2ea667119c0aeda764dcb53a2adf480a26985bfc682949d0fb0c02d266342c68
Formbook
40da3a76d7dfbe395b879dc9b090af73483617c65c7c433975490c0a22e4a71a
Formbook
5c175aad872d219fa23de0c83ea085fbdca8d76601167089b4e55ee66d520276
Formbook
5c6bb4be3e5abfc077f779645b07502ad3f9357fa3c486db79d0a2fb4f470527
Formbook
73db754f5e709731e9c07c230fa6512ee75e07184c367e3f80b1bf646e7b72da
Formbook
c18d5baf727358a8635a51fc7cfb4c3f4c90c78abcecf051feb4540323e98746
Formbook
f79690a1d55d2a07ff407ca6a7e74dfc8097d9c63d6fa59adc2e03c73d39290b
Formbook
ff577215d4aaa29ae63860167282ceeb0a703daadfdaef2155102500c269caa2
Formbook
+ 10'070 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:rqan loader persistence rat
Link:
https://tria.ge/reports/211008-n1tcqseba3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.cardboutiqueapp.com/rqan/
Unpacked files
SH256 hash:
18d5f2bb4c00c8e6fb62f43bc3878c615b600ec26bc25b98204cc2e945cd175a
MD5 hash:
b0d9d156b07f2199b3334fc6564c133d
SHA1 hash:
0c39614273b857121740e0142d1d9809de8bc41b
Link:
https://www.unpac.me/results/62d036b4-5ed9-4f28-9860-76c67c898dd3/
Parent samples :
b400601e35e72a20ca4a0fb19af7a93ddeddcd568674232cabb6c1e05ce4fd07
a643235802bd118331000b4a251952815382078dd0aaaded76e4a8890bbac5f6
33b01cf0eb422d872201670e34b732f76c980ae7ccb016068438272ed426a50b
fe6bd626fd98e3c0e4a2c350e5d927398e22e7731e7c2e1f31bc02181735c4e0
a97b00620e1e8ef9ef5c5f922f5b40ecf698504402d3e14979701c330bef7b56
90e1eac40edda005fffadbb1d16c652d16e685f8f4cf7375eb6ac928222c3a1c
1e54beecbd654f17bab2c6f883ea089943d68ae3e49aaea079182173dc203297
a0703367806de16bac9c75c016780c0bf3b1d8c21cf7f51b6a47b6a1aba74999
1ed62fd139d5efe1cb2650f52cf405d615dc19dae62744df9fb364cd1970a4bc
ffb6236e6dd03ba2599326f3d83d2ffabf8ab18902f1865aa0a68f1881e31978
99cdf3421923232c160c5075af3bf8620df65bd59cf99cc341f17a58e1eeb4f2
8f1eefd14608fae865576d9f7a24be116eb9d8dcebf89c954e2e645b06174c4e
f86258665b68d70e83397ac4ef17598c552b994dd13f26b8208c4d40b8e94816
ed78db064dfb4ae791498b2d08410a69bdad684ff709319d179c2383dd8e2f1c
3490cb5fd9a372722f95ed69c41e23d5cd274ce6b3c024ec1731962a380409d6
d86532a631143032da8dd4e4fd86cbaed87777ef2ede4a60377d534cb9ea7271
298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f
ffb0bd5cf5a1716fa50f01a4b4fd98d396842c7c263d3ce03623748430b30a93
a2067e35b12b83ddae55145931870302de477b5ccce82a5e86ea7bf8e057d8d7
a2539269c2b9200d7baed9f0dfc25b59fd4713a641d79fd9bd13272c7e1296ca
0aff281c192e919ce8a4e2091a058aa3c8fab2379dd50d7dd7ac7217af4dc838
cc8b096d71a4734e17e6f1bcf10d9730e5a2b3ab15b7e89852a4cdd204563d29
1e24e03e9ffdbe39ca8d357d0130aff5c50f2ddd7b2f613ab9dc01f02d0527d3
f60b6dfcaf466a9cf6b7831fcd74abc70efc16aec11d3b38fdbc7562003ba61b
67c445ff181fcaa6b46a1d1af78a9df1ac413593f29561e4fa43059c7ed85ace
SH256 hash:
96a54086e0d1667ed27dacd61ce88129d2ae1236718babe4ee5b3054385cc215
MD5 hash:
b8af003d11b6ffd7a6dddd4fcf35bf3c
SHA1 hash:
792b723347fdfc886d1d8a365d1031bb83de451a
Link:
https://www.unpac.me/results/62d036b4-5ed9-4f28-9860-76c67c898dd3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/96a54086e0d1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.74
Link:
https://yomi.yoroi.company/submissions/96a54086e0d1667ed27dacd61ce88129d2ae1236718babe4ee5b3054385cc215

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 96a54086e0d1667ed27dacd61ce88129d2ae1236718babe4ee5b3054385cc215

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1657308/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1659295/
Cape
Cape
https://www.capesandbox.com/analysis/196139/

Comments