MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5274ba8134766200b290850f0e50f910a734da64bc5d8dc8faeaeba92c39722. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5274ba8134766200b290850f0e50f910a734da64bc5d8dc8faeaeba92c39722
SHA3-384 hash: c32fa3d41bb8afe3b717141fc7b151b691fe91310deb974dbb9f0d24e1496fc67ef439684e7697dd18eee6b2533fd01e
SHA1 hash: 466eaa98f61159c68f3206fe0c3db5596835bff4
MD5 hash: e472f0234a4907007ae8de5038507835
humanhash: kitten-washington-blue-speaker
File name:e472f0234a4907007ae8de5038507835
Download: download sample
Signature Formbook
Create hunting rule
File size:1'833'544 bytes
First seen:2022-11-11 11:24:21 UTC
Last seen:2022-11-11 14:20:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ee5612dffe4cd5c13fb65a3e987147a3 (3 x RedLineStealer, 1 x Formbook)
ssdeep 49152:nZDsuvM2X1Mixccw1lwlERNP69VQisDCELY:nbbMiKbslEy9Kiph
TLSH T1B085015E5771A8C5EC74333020BF9E972E7FE1248E1E55E156CA732B1FE0A2C8921761
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c4d2d0c9d8d8c8f9 (3 x AgentTesla, 2 x Formbook, 2 x Rhadamanthys)
Reporter zbetcheckin
Tags:32 exe FormBook signed

Code Signing Certificate

Organisation:*.copel.com
Issuer:GeoTrust RSA CA 2018
Algorithm:sha256WithRSAEncryption
Valid from:2022-09-15T00:00:00Z
Valid to:2023-08-18T23:59:59Z
Serial number: 05f31f07b9171658c3862bd9fd4edb3f
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 12f0a786320f6faceefaa06ed9dc44139bb27834442fc7872e6d261afb3f0517
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
e472f0234a4907007ae8de5038507835
Verdict:
Malicious activity
Analysis date:
2022-11-11 11:26:47 UTC
Tags:
formbook trojan stealer
Link:
https://app.any.run/tasks/2d53ee9c-8e59-4966-90cc-cdc749741747

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/332446/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.8828.8875.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Launching a process
Сreating synchronization primitives
Searching for synchronization primitives
Sending an HTTP GET request
Reading critical registry keys
Creating a file in the %temp% directory
Stealing user critical data
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/51321/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/636e311082dd9f2e26538ceb/reports/9b8aa838-121d-4875-90c9-ad4a59628b63/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/20570494-4caf-4176-929b-7169188d173c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1111229
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 743924 Sample: pitUbg1Fc9.exe Startdate: 11/11/2022 Architecture: WINDOWS Score: 100 33 Malicious sample detected (through community Yara rule) 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected FormBook 2->37 39 2 other signatures 2->39 7 pitUbg1Fc9.exe 15 2->7         started        process3 dnsIp4 31 gollachutbd.com 103.147.182.74, 443, 49697, 49698 DHAKACOLO-AS-APDHAKACOLOPVTLIMITEDBD unknown 7->31 21 C:\Users\user\AppData\Local\...\advapi32.exe, PE32 7->21 dropped 23 C:\Users\user\AppData\...\library[1].bin, PE32 7->23 dropped 41 Writes to foreign memory regions 7->41 43 Allocates memory in foreign processes 7->43 45 Injects a PE file into a foreign processes 7->45 12 InstallUtil.exe 7->12         started        file5 signatures6 process7 signatures8 47 Modifies the context of a thread in another process (thread injection) 12->47 49 Maps a DLL or memory area into another process 12->49 51 Sample uses process hollowing technique 12->51 53 Queues an APC in another process (thread injection) 12->53 15 msiexec.exe 13 12->15         started        18 explorer.exe 12->18 injected process9 dnsIp10 55 Tries to steal Mail credentials (via file / registry access) 15->55 57 Tries to harvest and steal browser information (history, passwords, etc) 15->57 59 Modifies the context of a thread in another process (thread injection) 15->59 61 Maps a DLL or memory area into another process 15->61 25 www.5cfjmzy16s.xyz 154.213.29.126, 49699, 80 YISUCLOUDLTD-AS-APYISUCLOUDLTDHK Seychelles 18->25 27 natroredirect.natrocdn.com 85.159.66.93, 49700, 49701, 80 CIZGITR Turkey 18->27 29 2 other IPs or domains 18->29 63 System process connects to network (likely due to code injection or exploit) 18->63 65 Performs DNS queries to domains with low reputation 18->65 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5274ba8134766200b290850f0e50f910a734da64bc5d8dc8faeaeba92c39722/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-11-11 11:25:12 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
19 of 39 (48.72%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uutuxkati5tcaczjbbipbzipsefhgtngjpc5rxepv2xlvewds4ra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:jrhs rat spyware stealer trojan
Link:
https://tria.ge/reports/221111-njajaseh65/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Formbook
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5219c770-f905-430e-afe6-b452b039e790
Unpacked files
SH256 hash:
80a589c25cd234a8df7106ac21e87690e8e9ca62228c48223a61a2516a8396c0
MD5 hash:
6cabc0908f8677639cc949bc1de799d0
SHA1 hash:
abdd9c4e538e2166857d1d7c4db21f4c11ccde29
Link:
https://www.unpac.me/results/8ea9990a-056d-4b5c-b8ff-58dd3bfbfdf1/
SH256 hash:
c5959ad79729b3f73d8a4effcec9521ba06e66c86ccb4937663b0d7e5e8d1259
MD5 hash:
4334a2a07d9ed19de318740a3d4c6a2e
SHA1 hash:
2afd3d4bdc7b1b31ef498de2662f7d9dcbadbbc5
Link:
https://www.unpac.me/results/8ea9990a-056d-4b5c-b8ff-58dd3bfbfdf1/
SH256 hash:
a5274ba8134766200b290850f0e50f910a734da64bc5d8dc8faeaeba92c39722
MD5 hash:
e472f0234a4907007ae8de5038507835
SHA1 hash:
466eaa98f61159c68f3206fe0c3db5596835bff4
Link:
https://www.unpac.me/results/8ea9990a-056d-4b5c-b8ff-58dd3bfbfdf1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a5274ba81347/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5274ba8134766200b290850f0e50f910a734da64bc5d8dc8faeaeba92c39722

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe a5274ba8134766200b290850f0e50f910a734da64bc5d8dc8faeaeba92c39722

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2407810/
Cape
Cape
https://www.capesandbox.com/analysis/332446/

Comments


Avatar
zbet commented on 2022-11-11 11:24:32 UTC

url : hxxp://46.183.220.20/250/vbc.exe