MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6b0bb9378be58f9e3671746df1965e1e0b29642a6ac9d13873e7d347469b2ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6b0bb9378be58f9e3671746df1965e1e0b29642a6ac9d13873e7d347469b2ff
SHA3-384 hash: 8f231530b761ae824a3631abc0c82a1ec04fa25d7b094fbe9a1a62a78646e42ececf95c5179661ca0242cde83980ff09
SHA1 hash: 5c799fa4973c0fd626f683759441789b49275f04
MD5 hash: 2eb298bf38da601f2c19cd18f519e296
humanhash: happy-nebraska-alanine-nuts
File name:2eb298bf38da601f2c19cd18f519e296.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:464'896 bytes
First seen:2021-11-23 20:07:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:o0UzqmZNv+uhuDPSQ9ewQlMuiMre0tD00Xa:bkdDub9ewQl7Zre0C0Xa
Threatray 11'533 similar samples on MalwareBazaar
TLSH T1CEA401707358A3B3CA6E5EB40C2291C213316A612954D7DDACCD61CE2D62B9B9B137F3
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2eb298bf38da601f2c19cd18f519e296.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-23 20:19:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/16bd6a4e-770a-457a-837b-97c1e590c18c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit gorgon obfuscated packed
Link:
https://www.filescan.io/uploads/619d4a24f36138de3f37e525/reports/6cd629cd-7540-4c91-99a7-a4547e79efda/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a52d6437-02fe-499c-a568-61a7ace7df82
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/895024
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 527502 Sample: LlDlHiVEJQ.exe Startdate: 23/11/2021 Architecture: WINDOWS Score: 100 33 www.smartoo.info 2->33 35 www.christinasamano.com 2->35 37 2 other IPs or domains 2->37 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 5 other signatures 2->51 11 LlDlHiVEJQ.exe 3 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\LlDlHiVEJQ.exe.log, ASCII 11->31 dropped 65 Tries to detect virtualization through RDTSC time measurements 11->65 67 Injects a PE file into a foreign processes 11->67 15 LlDlHiVEJQ.exe 11->15         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 15->69 71 Maps a DLL or memory area into another process 15->71 73 Sample uses process hollowing technique 15->73 75 Queues an APC in another process (thread injection) 15->75 18 explorer.exe 15->18 injected process9 dnsIp10 39 ultimate-generator.com 162.241.24.173, 49810, 80 UNIFIEDLAYER-AS-1US United States 18->39 41 www.mariareis.space 162.210.102.230, 49814, 80 STEADFASTUS United States 18->41 43 6 other IPs or domains 18->43 53 System process connects to network (likely due to code injection or exploit) 18->53 55 Performs DNS queries to domains with low reputation 18->55 22 msdt.exe 18->22         started        25 autochk.exe 18->25         started        signatures11 process12 signatures13 57 Self deletion via cmd delete 22->57 59 Modifies the context of a thread in another process (thread injection) 22->59 61 Maps a DLL or memory area into another process 22->61 63 Tries to detect virtualization through RDTSC time measurements 22->63 27 cmd.exe 1 22->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a6b0bb9378be58f9e3671746df1965e1e0b29642a6ac9d13873e7d347469b2ff/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-23 17:28:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
014d0ece0d472eaea73698d634308303ddb9f227f39d339a66416c3cb744d2c1
Formbook
05c36634ef7b938c2494ed619644b03acf1add4bf7802238e7290af9185d3f78
Formbook
222c8a0ce49171c3bb93631e7001bb152ad05fa4ba13437a173f1d0dd9fd0a4e
Formbook
6139b0f3b5dd2fd5291edbcf9a4c082d21d4d5a424fb481030271230234f3751
Formbook
894f9fa39a5922cc3ec8d79c7957cfacbb99ce27c2b3babdb23e061a5a178ddc
Formbook
ba22bb07f3ef12877682493d25ed29cf6e2ca6c9ce2bc9527396a7bae00ec578
Formbook
bc4d625ec4ba48b9c17bcd907fe509539a12bb0d6103ff65a4e3c59fb4eca07c
Formbook
cf3038247c7a2a5779f655fdf594bdad56b22d198b6edb1c3197b84d9c4f153a
Formbook
e65d1335f3495f7d469bea81683253ee0845b3b3980cfaea09c4a7837a6c66eb
Formbook
f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175
Formbook
+ 11'523 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:rf5o loader rat
Link:
https://tria.ge/reports/211123-yv16habbdp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.smartag1.xyz/rf5o/
Unpacked files
SH256 hash:
f30ca642597c059f9dbcc6cfea27687245fbcaf5456be0b7a4528d946f3a0a05
MD5 hash:
0f6349011cf5446131faf0cadbace87b
SHA1 hash:
0cd48b5cb5a0ca095043c333c9002ba5273e92e8
Link:
https://www.unpac.me/results/c443b3ee-2c68-4d50-916e-8872ea576af1/
SH256 hash:
1e8437d938cdc24ae6f187783ba2861e477d27512aabefe0c48753b1475b6c0c
MD5 hash:
04212eedc55f602232688532570bef70
SHA1 hash:
3f0e2c9c48ba47970155eeb7373b89f3614e52d7
Link:
https://www.unpac.me/results/c443b3ee-2c68-4d50-916e-8872ea576af1/
SH256 hash:
6d9d0549b67b7a64fa3060b73b317ee1436193c87ef9e96ea66b96989497b538
MD5 hash:
53a213f42ae1d49f7a6b5c520df66448
SHA1 hash:
c4a5984bc6a2d8d3ffc16c9536697960d8ed1441
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/c443b3ee-2c68-4d50-916e-8872ea576af1/
Parent samples :
6139b0f3b5dd2fd5291edbcf9a4c082d21d4d5a424fb481030271230234f3751
a6b0bb9378be58f9e3671746df1965e1e0b29642a6ac9d13873e7d347469b2ff
48bfedd401aa3d6197c31f80ed6a77e589d6cbdc71d7a90e5b4b6add24f42041
2ee00fc9a73fae3aa751e75cada3a45e8691a61af4e1ded00c82aa36afb5c41b
SH256 hash:
a6b0bb9378be58f9e3671746df1965e1e0b29642a6ac9d13873e7d347469b2ff
MD5 hash:
2eb298bf38da601f2c19cd18f519e296
SHA1 hash:
5c799fa4973c0fd626f683759441789b49275f04
Link:
https://www.unpac.me/results/c443b3ee-2c68-4d50-916e-8872ea576af1/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a6b0bb9378be/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6b0bb9378be58f9e3671746df1965e1e0b29642a6ac9d13873e7d347469b2ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe a6b0bb9378be58f9e3671746df1965e1e0b29642a6ac9d13873e7d347469b2ff

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1808569/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208811/

Comments