MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a3a97e6801259fb5c604f364434f5c96c519dc979be88f69488a87e3b1fbd2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a3a97e6801259fb5c604f364434f5c96c519dc979be88f69488a87e3b1fbd2d
SHA3-384 hash: 75149c8b07616571747ac07c2cc1c943d7ad2bc12e45d17b7a67c8e072839d617f15a0419bc8daa92f696bf7e51ba81e
SHA1 hash: 07e68172cf7485b8921739037b3045742d6e87a5
MD5 hash: 1963afa9192dbc64dcf0f05a09ca4a84
humanhash: triple-arkansas-spaghetti-low
File name:SOR-0188-2022-E - Sea Orpheus.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:732'160 bytes
First seen:2022-09-05 06:09:56 UTC
Last seen:2022-09-15 14:20:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:tVF75e1ZuqRhf5O5zOJf2t51Yy8rZGGWvC0DsD88WV+kOGq+b6e6/U:tVZ52ZB7xOFEDy8r0Ru8LjBf
TLSH T170F48BA7C4E4FF13F2360E386370AE56822529374F998546E4EECBA161C6E35346F583
TrID 54.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
23.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
7.8% (.EXE) Win64 Executable (generic) (10523/12/4)
4.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.3% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0e4ac5cd3f2e8f0 (10 x Formbook, 4 x Loki, 3 x AgentTesla)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
9
# of downloads :
309
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
SOR-0188-2022-E - Sea Orpheus.exe
Verdict:
Malicious activity
Analysis date:
2022-09-05 06:12:40 UTC
Tags:
formbook
Link:
https://app.any.run/tasks/151fad0c-bd49-4d71-b8f2-69113e23094c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/307761/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1427-2.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Creating a window
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed remcos
Link:
https://www.filescan.io/uploads/631592f8c0ca34ef4c507936/reports/12ffa180-4f38-4deb-b5e1-eafaa3a12463/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f27d0181-8e36-4861-8e39-6809cf2b147d
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1064897
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 697423 Sample: SOR-0188-2022-E - Sea Orpheus.exe Startdate: 05/09/2022 Architecture: WINDOWS Score: 100 35 www.vuongnudan.site 2->35 37 www.kingdombuffmanager.com 2->37 39 2 other IPs or domains 2->39 47 Multi AV Scanner detection for domain / URL 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus detection for URL or domain 2->51 53 8 other signatures 2->53 10 SOR-0188-2022-E - Sea Orpheus.exe 3 2->10         started        signatures3 process4 file5 33 C:\...\SOR-0188-2022-E - Sea Orpheus.exe.log, ASCII 10->33 dropped 63 Injects a PE file into a foreign processes 10->63 14 SOR-0188-2022-E - Sea Orpheus.exe 10->14         started        17 svchost.exe 1 10->17         started        19 SOR-0188-2022-E - Sea Orpheus.exe 10->19         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 14->65 67 Maps a DLL or memory area into another process 14->67 69 Sample uses process hollowing technique 14->69 71 Queues an APC in another process (thread injection) 14->71 21 wlanext.exe 14->21         started        24 explorer.exe 14->24 injected 27 autochk.exe 14->27         started        process9 dnsIp10 55 Modifies the context of a thread in another process (thread injection) 21->55 57 Maps a DLL or memory area into another process 21->57 59 Tries to detect virtualization through RDTSC time measurements 21->59 29 cmd.exe 1 21->29         started        41 www.theburlyunicorn.com 24->41 43 www.shanizhve.space 24->43 45 2 other IPs or domains 24->45 61 System process connects to network (likely due to code injection or exploit) 24->61 signatures11 process12 process13 31 conhost.exe 29->31         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9a3a97e6801259fb5c604f364434f5c96c519dc979be88f69488a87e3b1fbd2d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-09-05 00:59:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ti5jpzuacjm7wxdaj43einhvzfwfdhojpg7ir5uurcuh4oy7xuwq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader loader persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/220905-gw2d8acbep/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Adds policy Run key to start application
Xloader payload
Formbook
Xloader
Unpacked files
SH256 hash:
adea027bd878f0e995c0066eb20764c3cd065056426063bb73e47cf4f2d58739
MD5 hash:
9881dfdc199c551f76dc404cc9fc9364
SHA1 hash:
626e6981aa2e0075950a9ea92c3d96a9ca088a83
Detections:
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/104689f5-d000-4e2a-aff9-b87d83f1e7aa/
Parent samples :
18ce13c9dc11ab8d14b603076b0d6f3141dd415314be89264c8ff742f01a13a1
b87ec1a86d0c11e1183ec3de93241427e393f0016ff662fe6c9d98af2faf22d5
985bff9f5d8470baf0a3c5520eae6e8bb87a9761bd6c7ce41855c5c8cc0a58bc
80752d3336e20d9b4cea4b4fc36fe2f455e4546a12525cf485e38281072c3633
077d4640e51e8a6cb8b05aafa60f5cb061619f556bed260481f2d537a57515d8
89f8e3f130e2c71f420c6c4a600167a5f76d1adf449b8d3e3d0b9af4d0006c2a
0e915f97c1e12598162ad86bde86879e640daa63cf463fc75302aab6a24c3b15
14017a5f9a46c97ba874b288cb1f56a9ce838a0f91c12d8fbfa4265cef0d312d
e216eb87e85cc5c7e5445d1ff94cf9790c62824c1fc5ca2a3e20f19d54d88ab5
e7cd0bf17d9a651f004222e85511d00d5ab27e21e0a47e9359263caa1280a28d
0e32bb72c1ef51858b7183050fccef196f8dd829796954dbe9a8fbcd65dc5021
d55b3acb7fbeaf698e8b940f755c1363224663da98feee5abf93872e979460e9
24cf298cfd5fd4bd6ffdbd3607aee52a39b3bf4db5123e403c05aae37f485058
58ffed8f3b25296ea15a8f5fe71625db5c1ebad7776b4aa5df441cd0246213e2
d08a604bd1b6b5b1ad0ba58434c156f6efde6b6a81d7956473b6d0731061e788
84cb97d382c34756564d3565524daf43425be7505178379782e50d1ba85b2334
44d486a7d9defaa2ed04fa0f3c7ab9973a8370e432fdb90c9418e3694fa65b2c
3a0f3af2723394a157e27c2f71dffa3c54802ae1cf4a5cff78a835afeffdf8c9
ff0c4eb94aa281998aa21d84093a51f525583bb2d333b9c02ea0599f3791e21a
eafff11f17167c7af139e43f9bffdb251cd5eec87d92cc93f0095b0f3eb38996
ad5003b210c5ed8b9de400328290e3955bdb07de23731475934c299a52dc6e98
9a3a97e6801259fb5c604f364434f5c96c519dc979be88f69488a87e3b1fbd2d
546d510fae0de29da545eda3203b4a47ea41ba27f8f134c0fe902a776ca6a054
10503ccee19c440f294f4e4833b8df43f2f8f4620f4af3f01dd0a74b11fed33c
fabf08da20fd8737e3fa9f8955422c8b12d14ca6d99fd16d13cdf5eedea58c46
fc359222307f4fb7aa112c091da0ed90481dea090ae53c9578cada9689da5319
5dd3a0a56d55816a0ffa7a9f2feb75613a68bd2ba9f145bd69ea616e8b8c9c9e
aecb569ce42aa96a5b4cdc6e4c2042bafe867bef4c51f0120ac81b09edb865e6
SH256 hash:
c45a3dae97e5e635a567df02635fe941af384f35cc993d4e52a57fa4f4026b3e
MD5 hash:
966c65a2893f62df72494272d810448f
SHA1 hash:
de82f765123b6ed954996603b663e9bac36acfb6
Link:
https://www.unpac.me/results/104689f5-d000-4e2a-aff9-b87d83f1e7aa/
SH256 hash:
dccc040b5e9267c685ae44d92a1278e7e21a1bee048a2ee35a5db83fc1604c37
MD5 hash:
4d2a861c366c91cf200af472a3088d6e
SHA1 hash:
967904ca1929b5ea1fd8c89df20d6c3221c42a81
Link:
https://www.unpac.me/results/104689f5-d000-4e2a-aff9-b87d83f1e7aa/
SH256 hash:
643c7065e85d58dc2c5232e4918d623c32db73c9e4d435f9f01f825ea60eb9a9
MD5 hash:
5302ea338bd3083e0f91d1ac0e4350f1
SHA1 hash:
2c5424369efdf65e2e0300ec4343373daea2a2b5
Link:
https://www.unpac.me/results/104689f5-d000-4e2a-aff9-b87d83f1e7aa/
SH256 hash:
9b4aee132a0228378d66a57fda3a2030952309ef74cf2db724ac916b04d8c034
MD5 hash:
93c6391d23c1aa1ed66fb13f82f2ee31
SHA1 hash:
220098c3047c32b51ae13a5cc1e9beeef3da6e18
Link:
https://www.unpac.me/results/104689f5-d000-4e2a-aff9-b87d83f1e7aa/
SH256 hash:
9a3a97e6801259fb5c604f364434f5c96c519dc979be88f69488a87e3b1fbd2d
MD5 hash:
1963afa9192dbc64dcf0f05a09ca4a84
SHA1 hash:
07e68172cf7485b8921739037b3045742d6e87a5
Link:
https://www.unpac.me/results/104689f5-d000-4e2a-aff9-b87d83f1e7aa/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9a3a97e68012/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/9a3a97e6801259fb5c604f364434f5c96c519dc979be88f69488a87e3b1fbd2d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 706d50824187fb595dc21c7e701f3f0b60baaea805b90d6bc9adb1d4c2f023fe

Formbook

Executable exe 9a3a97e6801259fb5c604f364434f5c96c519dc979be88f69488a87e3b1fbd2d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/307761/
  
Dropped by
SHA256 706d50824187fb595dc21c7e701f3f0b60baaea805b90d6bc9adb1d4c2f023fe
  
Dropped by
MD5 e9375eb3bd36b1960d55c248c1301612

Comments