MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2c0c62a11f867cff9fe7cd1b2597c9a7bb1c268e18e35289d6f7afdb2adbdbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2c0c62a11f867cff9fe7cd1b2597c9a7bb1c268e18e35289d6f7afdb2adbdbc
SHA3-384 hash: 6ff49546ac76b591736f70bafa308c0308deed1a10ba270f241a01862a88106ce292fddcdea3852d9e96ada2b4553cc0
SHA1 hash: 40575a12bb459daf68e663c904ca562439b10987
MD5 hash: 7cad10b26e1fe159aaecea5fe8db5d53
humanhash: south-oregon-batman-johnny
File name:TNT Receipt_TNTMX9886530.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'066'496 bytes
First seen:2022-03-23 19:11:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:m+4PFITr1/Dl8rPYB7Jyx2oKLQaQi5VvMnI7il:L4kr1qrq9ylZaYnH
Threatray 14'598 similar samples on MalwareBazaar
TLSH T19E35234822E1CE22D87D4B788451D2344775DC563212EB6A6ED86CBB3E7BB90DB205F3
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter abuse_ch
Tags:exe FormBook TNT

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/256822/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e4b3fe88-b2c0-4b5a-b398-1a9e653c9656
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/963110
Behaviour
Behavior Graph:
n/a
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a2c0c62a11f867cff9fe7cd1b2597c9a7bb1c268e18e35289d6f7afdb2adbdbc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 16:59:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
19 of 25 (76.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ulammkqr7bt476p6pti3ewl4tj53dqti4ghdkke5n55p3mvnxw6a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0da36b7f7e4b44b640ab5769532fdd7599032ca2b1d6b57807ba48ad1fa76780
Formbook
39d7f0b102aca1db8c71a3a7af79ece2aa2100dbaf1c20237d75e36271833ef2
Formbook
7bfabb3e53f70e2ad39155a8af8d7e27a07ec01b0ba8faed52cb569e4f78142f
Formbook
8ddf9843afa2f66549fe02a8ddc9811c2ca231f3107340272879da1a782159f9
Formbook
9f085df3f1da75ba799ca984603fe267f891be8e6ac24c52b907cc97e6879467
Formbook
b7f5857586780b4dba775eb6d75c03ee627405bbedf03c7e1966ec8abb3f2c6c
Formbook
c1657f01ccef85f3f46740a96704bc5dccfb4cf8fc9ac09abcfd7aa6660448f7
Formbook
c86f3a2110ed2a8498cf30d4ab88cf9ea18edc612835fe2b369e7596dafb802e
Formbook
cfd1a77378decd68cd7a59307b77b93247bdd91e00de5111ecae6b5658c8665f
Formbook
fce51b6f1f69629c651dfaedbcdcb55d25da39e8184614c1cb26e4c247f6d3ac
Formbook
+ 14'588 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:sj8q loader rat
Link:
https://tria.ge/reports/220323-xwh6msach8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
6d0548df967b7390cfd5bcf0969bd64a4f4f682053e64336b7f698c45e6efbb7
MD5 hash:
8112b6330d54935ca1c897b73c02d32a
SHA1 hash:
4de0774399802342d005f395a7fd0ed8a7ad3d46
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/99ad1016-cd52-4705-b92b-ba4720612aaa/
Parent samples :
83e2d139b07165c8ee6bb9253d4a1df920ee6cebaa0d5bd16723848dc0c5613b
782df1aaa2744ba6a9efd5c9c05e16293e43a10093ab651866ceb009f977a9f6
350f69de23d0f180b69a85ef2b3a09195ebb95ac525d09082504d955f63f59e1
c86f3a2110ed2a8498cf30d4ab88cf9ea18edc612835fe2b369e7596dafb802e
a2c0c62a11f867cff9fe7cd1b2597c9a7bb1c268e18e35289d6f7afdb2adbdbc
439db5f69b49091964c335c5977bc6dbf8aa41398d0240410dfeb898add7dace
934cdab74883aa6b38f53310f73ffd5b8c4a175fad14b9eb5c6873653242410b
SH256 hash:
b24925071f31a085ba890e8c871ad8d524f3bfa7fa17b610e2aa97af69494f43
MD5 hash:
06aa71bb77d2f8ae4cc10c77d1a52058
SHA1 hash:
f084ed356a5c5d8f84c023a53b95be018a2cd8e6
Link:
https://www.unpac.me/results/99ad1016-cd52-4705-b92b-ba4720612aaa/
SH256 hash:
dc5c057b0ee1eb079cf189762aac69f0d86338ea18795dc4fbf7ed9b5a45c2eb
MD5 hash:
4103ed94f4747b30e166cf3c25416f47
SHA1 hash:
d553a67056e94f60d621ca42dcecd6d93f9ef1ad
Link:
https://www.unpac.me/results/99ad1016-cd52-4705-b92b-ba4720612aaa/
SH256 hash:
5b5b32781367776313383dd686e1a34cee3fb0f77cef260ef95947765ef98b86
MD5 hash:
fe59eec3e7bdaf074513309dfe812e69
SHA1 hash:
28dd0c96646deeba1d68a24931ac3294fc40a438
Link:
https://www.unpac.me/results/99ad1016-cd52-4705-b92b-ba4720612aaa/
SH256 hash:
6f78c405af266c426641dc34318e1d552f34a9b760060019b9b3a8875a383cac
MD5 hash:
76e82346e4ad464e1bf90304780dfb5b
SHA1 hash:
dd99eab9a9461a4d3a75256355f84879deafa0ab
Link:
https://www.unpac.me/results/99ad1016-cd52-4705-b92b-ba4720612aaa/
SH256 hash:
a2c0c62a11f867cff9fe7cd1b2597c9a7bb1c268e18e35289d6f7afdb2adbdbc
MD5 hash:
7cad10b26e1fe159aaecea5fe8db5d53
SHA1 hash:
40575a12bb459daf68e663c904ca562439b10987
Link:
https://www.unpac.me/results/99ad1016-cd52-4705-b92b-ba4720612aaa/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/a2c0c62a11f867cff9fe7cd1b2597c9a7bb1c268e18e35289d6f7afdb2adbdbc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe a2c0c62a11f867cff9fe7cd1b2597c9a7bb1c268e18e35289d6f7afdb2adbdbc

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/256822/

Comments