MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2e38d4884cd9695e60fe38a8ebf15d7ed77bdf121212282aba5389b550c4d0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2e38d4884cd9695e60fe38a8ebf15d7ed77bdf121212282aba5389b550c4d0e
SHA3-384 hash: 59dabcafcb8685065315d6a2cd171edbed09455a8ebf2401f704fca94058ca7cd559a986260b80226e8d61997b915f56
SHA1 hash: 7be0cad96443f8844420f976dde5a3f0c1689c0e
MD5 hash: 6956fa07c90de3ddd63a4e3c48d56fdf
humanhash: solar-kitten-lamp-quiet
File name:6956fa07c90de3ddd63a4e3c48d56fdf
Download: download sample
Signature Formbook
Create hunting rule
File size:511'488 bytes
First seen:2022-06-28 08:32:14 UTC
Last seen:2022-06-28 09:39:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:EB/YT5YA8Xj4cDeY+3HlpFsFoo4FoymOLs00t74kOO6XQ2SVVgdBZ24YDCjV1W:EScjLe/3HLk4FVmos0W74PO1VVSBcWh
TLSH T1D4B4128023D42FAFD5A9D77B92B01052137CAAF71842F76EA684F29D1A723D0C5235E3
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2f949b1bafab8b0 (18 x AgentTesla, 17 x Loki, 17 x Formbook)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/283825/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62babcc62ce3827836e3162d/reports/a3dc8acf-378a-44b8-96c6-c7e7966953f0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b0f428ee-ead9-4ae4-baf4-2333f82839f2
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1021008
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 653500 Sample: wVsOMeR93y Startdate: 28/06/2022 Architecture: WINDOWS Score: 96 19 Malicious sample detected (through community Yara rule) 2->19 21 Antivirus detection for URL or domain 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 6 other signatures 2->25 6 wVsOMeR93y.exe 3 2->6         started        process3 file4 17 C:\Users\user\AppData\...\wVsOMeR93y.exe.log, ASCII 6->17 dropped 9 wVsOMeR93y.exe 6->9         started        11 wVsOMeR93y.exe 6->11         started        13 wVsOMeR93y.exe 6->13         started        15 2 other processes 6->15 process5
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a2e38d4884cd9695e60fe38a8ebf15d7ed77bdf121212282aba5389b550c4d0e/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-06-28 07:03:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ulry2seezwljlzqp4ofi5pyv27wxpppreeqsfavluu4jwvimjuha._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/220628-kfvhhsaad4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
b1de7261dc9056b8d77c80645134778aa4876d3b42db5892fb139582c1e127fd
MD5 hash:
0138c51a1a90974f9a168c839f88b124
SHA1 hash:
8c5a9536f0ca43e06d45507345233723bad07c56
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/675d10de-47fb-4472-9649-094f7d08f3c0/
Parent samples :
a2e38d4884cd9695e60fe38a8ebf15d7ed77bdf121212282aba5389b550c4d0e
714a619165308ef492029ca21f0c072a5d643427e08af2335a9688fb5070f0cb
SH256 hash:
0aa8ea56f670ef5041fe87ee1a27b6623c2cf7996ed489214aa076996ca40cac
MD5 hash:
faf84cab64260654988db2f9157f8f89
SHA1 hash:
e1e6ebeaf252c78e74c1355cdefc6a2c52cfab70
Link:
https://www.unpac.me/results/675d10de-47fb-4472-9649-094f7d08f3c0/
SH256 hash:
0cb6aef1fa57d11408e47ae071485ef8f48c2982997b8d74b47a4151d85b978c
MD5 hash:
843aa6edf83bff7b61c6a5369ef41e95
SHA1 hash:
d1bfeec8eaac9a1dacf2f7062ce964d8e7d77085
Link:
https://www.unpac.me/results/675d10de-47fb-4472-9649-094f7d08f3c0/
SH256 hash:
076450b74f90388d124abf3961abf2bd8ab240f56810eded354cb097ea74ebfc
MD5 hash:
7746b7847c5c091af707c738fdf4835b
SHA1 hash:
68e33b92a637d3b829b19830b44aa850d6b33a6d
Link:
https://www.unpac.me/results/675d10de-47fb-4472-9649-094f7d08f3c0/
SH256 hash:
c9b71cc755407828f90e86c803130e6cf3ca053e12d214c3000480c444e056dd
MD5 hash:
56beeda276ba65c21107797993114d18
SHA1 hash:
415ecd5794bde8781f6d84aaba4678e68d3977f6
Link:
https://www.unpac.me/results/675d10de-47fb-4472-9649-094f7d08f3c0/
SH256 hash:
a2e38d4884cd9695e60fe38a8ebf15d7ed77bdf121212282aba5389b550c4d0e
MD5 hash:
6956fa07c90de3ddd63a4e3c48d56fdf
SHA1 hash:
7be0cad96443f8844420f976dde5a3f0c1689c0e
Link:
https://www.unpac.me/results/675d10de-47fb-4472-9649-094f7d08f3c0/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a2e38d4884cd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/a2e38d4884cd9695e60fe38a8ebf15d7ed77bdf121212282aba5389b550c4d0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe a2e38d4884cd9695e60fe38a8ebf15d7ed77bdf121212282aba5389b550c4d0e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2251961/
Cape
Cape
https://www.capesandbox.com/analysis/283825/

Comments


Avatar
zbet commented on 2022-06-28 08:32:26 UTC

url : hxxp://85.202.169.21/bluezx.exe