MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
SHA3-384 hash: bfc6e994f88e127cc7eb3d1a48e6bceb4dbaa186c1b2058ddf357a0278d04a287b74e5c9fc2fcd23a181d924028b5856
SHA1 hash: 8b9e42afa53aedfbe89964ce50ab2dd15f7cb725
MD5 hash: 840e01d333583e11b123c378fc7741e4
humanhash: robin-batman-maryland-steak
File name:SecuriteInfo.com.Trojan.Risis.1.Gen.6650.11337
Download: download sample
Signature Formbook
Create hunting rule
File size:466'946 bytes
First seen:2021-12-17 18:52:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 12288:3C8ayCBzXRGDH8vk6Ssj4ThacujdpsXAeoxmm8Fr:3CpyCdEDcvJzcux/eoom8l
TLSH T151A4230C96D22257CDF965742835B3B7D2FBC381120604D5A3AA6F5F9271A83CE9A8F4
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/214869/
Detection(s):
SecuriteInfo.com.Trojan.Risis.1.Gen.6650.11337.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
DNS request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2407/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61bcdc91a2eae65b861f8ec0/reports/ac931111-c48d-4d82-8c35-7cf08331a9eb/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b1c2b7aa-e2c0-4ad2-85e1-3b9ebf241c71
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/909286
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9/
Threat name:
Win32.Trojan.Mamson
Create hunting rule
Status:
Malicious
First seen:
2021-12-17 17:16:54 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugyears32zixarsc33vqfkzkubqpf5sbqozjobrmaepbarlcpguq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:fqiq loader rat
Link:
https://tria.ge/reports/211217-xjmcjaegfr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Unpacked files
SH256 hash:
e1ba03c0a2c7bf0d4713686e83cdc929241a7357c9f87e3f304bcde72dd8f72a
MD5 hash:
b71cd7a9c1286c6f628edcb3b7acf30b
SHA1 hash:
38cf6abd7b34a83cd4e89e57d035e1b5ba815baf
Link:
https://www.unpac.me/results/1aabadb1-6e05-48a8-9059-0d099d91ba67/
SH256 hash:
36962a581f91e7f4920e3da5c34a4753efa23e5dd51822b52fa726c44aa3be51
MD5 hash:
0fcc97c13416adb52d58364646db8ef8
SHA1 hash:
8fba0404952912070ee5ae0ac760519f498daf0f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/1aabadb1-6e05-48a8-9059-0d099d91ba67/
Parent samples :
6ffe756ce71f1457d7dd480357f3545f123b750fc4bf30683b59887d491948a7
092be1f456b0c24d932d6c4e4c44cfd0c9abc6c0418bf1567e67826cb51aef14
91a166f9a29ad832c9640078210a47e5afa928ab1a79a7b40d3b358e9c8bc5d5
9136c283e5029c2f073b706014f6f73b67ead84450267cb5ce0dd26cbcecaa25
89b049bc712096512185d1607a9318c074885b2d5b529e0985dc92cdd94d1f51
d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636
ba22bb07f3ef12877682493d25ed29cf6e2ca6c9ce2bc9527396a7bae00ec578
4340e97182604cbe78767ba17c66b1d106d7e28855fc5ef3737142b41656cd9c
6d2abaaa61c35b3bc1cf8ae531dd9505406379b70f414f806974d0202365d14e
1d3c91b0ec0e3b039a78c042eec94a3aebbe5da4d6e61cf7b7e54de22084d4a3
aaf0400f83fd271800e1f4cb50fab438958eb3771a6b6a9401c5fa66c1c5b956
832c65a202ec1c69a8297af3d2fc3d233ac65b7c2c670f30d0694089601c9cfe
58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57
36465b5c8b0baa57cc7d26405d290bff57488f216c72654b2773e506dc6646df
b16670d7ab7fc43029ef6033d5bf6b8a3ad78f09fefed66ec6351c7eac0a53f8
37669e84be570d6748f6bae3adbaf41a969894111073837204f526a1f8c8dad9
c0363e690238ce1be218baa1c66a3fe647df3740da9448788945c6863ac6b07c
a104d6d98afd1eca774c2b8b12aee19bbc52216a358d9bf00ebfb503ef8e553d
0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802
060c2f164a53cf74817b9b2f176d770dbde8b1ef71fe5322abf9ae8197232b7d
43d01d2eb5232707d644d1ea624c347b98220adbbdb7a8bd625814a5b971dd2d
37fe8e29a0b03c101b7de698fe335669bd98d2f4afdbe202bca00ceef540bd5d
88162d7f1cc5091fe38963f350017010d2ff7167e4d50c84599ad9f3b29a1a2d
5fa1ff89c81ecaec98e5995fbfe4df5caaa1da2f514d2deefff5ea91938d579f
b2663af445ff18476795d3462841a45488a9f2fd53c92d0c798e2e24892e10ae
cd9c2941f474d97ebaf1b88641fa3153958c8936939b77e0a62fb19fa488b25f
be6f833816e4dd59791654e138d793e1bfb6bfe016f34ae63b9b3e2f6106fc55
1764a3523eb73d0b632820c013bb2a723fbb3779c7eb59c7e0b67cd488deda6d
f0a7f92f4fa639da7f829e82242a21aa8861bc98f1783b51638e04dc148e81b5
92dfbdc903edcc919f426dc689d4461d354d15d77bf7f865db884f5de11d1253
29e85e2310c309eb1fc9939287177b02a8b4b096c2b600b2bd47a8e1acb58f36
28903cad5faee3c56985c052982d83527166253a85a74315ecca8d6dc17e6a59
ff50a282945cb9b5a738f97aa08714f874469eaa4ed79fcd0c5fd0c12d6a4be8
3d50a61d513475fc02d1685b3e4af3d10c2b23136c41703552e0e41b35fbeae9
7e6b468c991367b78ad9d9a9437ab4a4efd789203038a75e687cc3beaa346dd7
ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb
19e393a62338d6cc292c4aadeab10121a453635fdb5fe291d295a3a6fc6ef712
d042461c8232d82419b3c843757d65e0e3ccfcdaf7d12c03c7e027f5b8639854
7a1a96acb6fbf74b821d7cad25b8912cbb97ea2eb4b847289cc0486705984fda
6b9d128b143bc2ec8b72ac36891a5b12887f182de44ae5e367c0a486b774a59f
12c431c9695b91725092b2261e1f4d251d682fdc0784ae3c7df3a7a478f194f6
dab06b4d2862c59c9a454d29852d9bf4a15462d660ff65e0a29d987d6b8f320c
63c0f55aa5ab5b3cd05a335deb13a29dee7f1bc41b860c716239c44a2bef39f4
7538dd54090aa1debe47b52503cf0099fe2b2839f08ff282dacd31734a0bcb9a
55b588d9d763bee7e3a03b6bb027af6ccd779fadd9022696d31e102a97f1b18b
dcd2e00fc2a47d732fd3d0d79fd224caac8bee02053a1b02ba4e51e022a949f9
bd7cddd657e0144076352a60664ca134c2ddee8ffe8da70793d5b97f17cf9318
933a2e4716b395f6fa6aed9ae203901742b7993fdb29d5b2f56a3c82f80fc095
b30e2fa345e02eecf58f3672cab4f07b4c6f84712c7dee9a64ca3005ac7bf255
a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
821d7489d8ef08b8ebdfb08350ac7cf3ae8ac918b4a1aa4bcbbcc0ffbd668059
SH256 hash:
a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
MD5 hash:
840e01d333583e11b123c378fc7741e4
SHA1 hash:
8b9e42afa53aedfbe89964ce50ab2dd15f7cb725
Link:
https://www.unpac.me/results/1aabadb1-6e05-48a8-9059-0d099d91ba67/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a1b040465bd6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1893555/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/214869/

Comments