MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a65e0c7aa04fbcc56fac5fec78b13d51f6c17fe0ba7f34a58a0529bd414048f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments 1

SHA256 hash:	a65e0c7aa04fbcc56fac5fec78b13d51f6c17fe0ba7f34a58a0529bd414048f2
SHA3-384 hash:	354db63023dc4f5ef1564f3937a50c4f757abbbd512f9bd27218cd6e18a23b9117d0c56b9f136ccc2d354971eb012342
SHA1 hash:	9a18145e1f86453946eaec5729122a7ed0468c3c
MD5 hash:	06a6fde8820e5b264055bd2fa1fa3f42
humanhash:	blue-stream-yankee-nuts
File name:	06a6fde8820e5b264055bd2fa1fa3f42
Download:	download sample
Signature	Formbook Create hunting rule
File size:	404'992 bytes
First seen:	2021-12-22 18:27:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:qOBGry2egzAd0m9FCNp1EhVEbnCPQYxt7wcctGG:b2egz8X9u8mbnCPQYz7wcQGG
Threatray	12'434 similar samples on MalwareBazaar
TLSH	T14D8422623B972389E1BD8BF6A1B0127017B5E22F25B5C7098CD454DB58373116981FBB
File icon (PE):
dhash icon	b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

233

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Swiftcopy.doc

Verdict:

Malicious activity

Analysis date:

2021-12-22 16:30:15 UTC

Tags:

exploit CVE-2017-11882 loader trojan formbook stealer

Link:

https://app.any.run/tasks/2baaeb16-a5fa-4311-8967-452a10d03f64

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/215833/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.1140.2574.8804.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Unauthorized injection to a recently created process

Creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

75%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/61c36e37ec6c6c14a9ea9650/reports/5ffc78b4-ae5f-484c-80be-2020665102d7/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/911684

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Self deletion via cmd delete

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious Svchost Process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/a65e0c7aa04fbcc56fac5fec78b13d51f6c17fe0ba7f34a58a0529bd414048f2/

Threat name:

ByteCode-MSIL.Spyware.Noon

Status:

Malicious

First seen:

2021-12-22 17:15:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 28 (67.86%)

Threat level:

2/5

Verdict:

malicious

Label(s):

formbook

Formbook

37c61785c47820bbfd4198b8ff7c9db451bdde81371b5dde948b6aeab76a36bf

Formbook

62f75c04145584721209a0d160d0f6b374e6b9465a759aba8e3f6c89ae67938f

Formbook

656fdcc2e4073fc782bf9d9ec1e6f7390d815d69cb684276293f08c05330c4ad

Formbook

6d6b50ac34692e324b25147855ff3a075b1d5505f7fd550e405bca20ad94879a

Formbook

8b47208af9a6ddc6cbba36c03495fb4308c64b18bd455925502c9e39326e693e

Formbook

90b68aa14301d8c578cb7f9a4e3536b54c399f346aed82f19682604f31823cd5

Formbook

ace8d85c2f02bd3d531cd8d609d23c6d35588ecce52f40a8d129b39a6b1d7723

Formbook

cb13b76515eda9a32e999b61c7e11e01de16ebeaf9ae6c503a1a0d238bc5bf37

Formbook

e22a659b73048b31aba79fce8de22ddd5a287494b763fec8d5779869dfebbf31

Formbook

+ 12'424 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:m1x9 rat spyware stealer trojan

Link:

https://tria.ge/reports/211222-w4bwvsgfbk/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Formbook Payload

Formbook

Unpacked files

SH256 hash:

217d023c1ce88ff81a11918437063a7c18eb3ba1a3a97e15a9abca2047a53696

MD5 hash:

7492ba85c9fe2c964c7fa7fd13c2eed3

SHA1 hash:

856e9f14d9d20b3a6bff691daf4a90e20e04d372

Detections:

win_formbook_g0

win_formbook_auto

Link:

https://www.unpac.me/results/d7ae4927-08f2-4dac-85a4-b00e52e56dd4/

Parent samples :

cb13b76515eda9a32e999b61c7e11e01de16ebeaf9ae6c503a1a0d238bc5bf37
90b68aa14301d8c578cb7f9a4e3536b54c399f346aed82f19682604f31823cd5
a65e0c7aa04fbcc56fac5fec78b13d51f6c17fe0ba7f34a58a0529bd414048f2
db31c01119f54e596eccec7e9d909d3344f42e82db94f348cdb0ace3d8ba9bab
952277c9dfd5bc4d0ccaf19fd51f58c94bf5993705b150168e3395dab1943a41
b1e658a2886741cb4883dac05d48a62e8d01f6f84af78f2ef5beb78ced173c8a
5c3579c7b2c142c402b4956cb0ce490a3933a3b1ea4d5f937037b117fbc1497d
28323d3c8fd1339a7d4f0ebad6ff377545e88c15fdca9b2f21cdd7c72c07622e
d67dff51d41111e44fe4dc61b5c741d7cae81e1397dbf55bdd3bd0dc144f342f
d07c78ca44c6b0f13f00ecb09e9716eb8d85d6a9baac7eca18c08477f9972840

SH256 hash:

8c1b6153af4fbb77e283b7046a575ef74c86479c6a6af3d0f0ff804ccda370be

MD5 hash:

79164f95dedfd79889bada9df0455644

SHA1 hash:

5d0302786d28c7fcda0c664635b661fbd29c9b52

Link:

https://www.unpac.me/results/d7ae4927-08f2-4dac-85a4-b00e52e56dd4/

SH256 hash:

55535d7416e19740ddca81496bcfb9ea7f4ec52735e01d43880f6359f92b63be

MD5 hash:

42c16475606875decc737cb31dfb2cbb

SHA1 hash:

28db67a9058bbebedbd28819bce871cdeb62f968

Link:

https://www.unpac.me/results/d7ae4927-08f2-4dac-85a4-b00e52e56dd4/

SH256 hash:

a65e0c7aa04fbcc56fac5fec78b13d51f6c17fe0ba7f34a58a0529bd414048f2

MD5 hash:

06a6fde8820e5b264055bd2fa1fa3f42

SHA1 hash:

9a18145e1f86453946eaec5729122a7ed0468c3c

Link:

https://www.unpac.me/results/d7ae4927-08f2-4dac-85a4-b00e52e56dd4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/a65e0c7aa04fbcc56fac5fec78b13d51f6c17fe0ba7f34a58a0529bd414048f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

exe a65e0c7aa04fbcc56fac5fec78b13d51f6c17fe0ba7f34a58a0529bd414048f2

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1862603/

Cape

https://www.capesandbox.com/analysis/215833/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-12-22 18:27:08 UTC

url : hxxp://kizitox.cf/mazx.exe