MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab2af768a15bf36f36de51389f4ee62cb0816779473a53716cee76734bda7538. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab2af768a15bf36f36de51389f4ee62cb0816779473a53716cee76734bda7538
SHA3-384 hash: 363fa28380dc098bef53a0f9cdca0dc896a4f9db217beaed3302aacd9f73a65408fbf1978cd24737758185515c2eaf73
SHA1 hash: 9c774e98b87394627d311a552d8bde85d57b327c
MD5 hash: 3b61d04e555f74f42e22c71a5885ac71
humanhash: leopard-nevada-kentucky-hawaii
File name:PO KIPO000903 KIND122822.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:651'264 bytes
First seen:2022-11-28 21:21:13 UTC
Last seen:2022-11-28 22:27:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:yucKpbKbf92TXwpL3sMcIobFB5BD8tVvkwkrscPA3QR+:yF4bKOORcIoxBDr1P/
TLSH T150D4121231AE0768D75DBBF228E1D34477B1BE3A5423D46E2D8C72CA59337449E34B2A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
262
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
PO KIPO000903 KIND122822.exe
Verdict:
Malicious activity
Analysis date:
2022-11-28 21:23:41 UTC
Tags:
formbook xloader trojan stealer
Link:
https://app.any.run/tasks/bd64b125-a661-4edf-ba00-6982aa4bb42e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/339552/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.25441.29217.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed phishing
Link:
https://www.filescan.io/uploads/6385267b559d07a06f481594/reports/07592f22-9620-4859-b526-908c0b742ecc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/73ecbedd-e861-4b59-9275-dbc9b61fcdbd
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1122896
Signature
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 755620 Sample: PO KIPO000903 KIND122822.exe Startdate: 28/11/2022 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 7 other signatures 2->42 10 PO KIPO000903 KIND122822.exe 3 2->10         started        process3 file4 28 C:\Users\...\PO KIPO000903 KIND122822.exe.log, ASCII 10->28 dropped 52 Injects a PE file into a foreign processes 10->52 14 PO KIPO000903 KIND122822.exe 10->14         started        signatures5 process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 Queues an APC in another process (thread injection) 14->60 17 explorer.exe 14->17 injected process8 dnsIp9 30 salon-atmosfera.ru 31.184.217.9, 49703, 80 SELECTELRU Russian Federation 17->30 32 www.schoolcut.org.uk 199.59.243.222, 49702, 80 BODIS-NJUS United States 17->32 34 www.salon-atmosfera.ru 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 cmd.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab2af768a15bf36f36de51389f4ee62cb0816779473a53716cee76734bda7538/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-28 13:23:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vmvpo2fblpzw6nw6ke4j6txgfsyicz3zi45fg4lm5z3hgs62ou4a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
cobaltstrike
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:d94i rat spyware stealer trojan
Link:
https://tria.ge/reports/221128-z7wbfsbe2x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook payload
Formbook
Unpacked files
SH256 hash:
c63d3b688408e8df8daa0e723aba1ab018f766d1244d603f88688b13d54698d6
MD5 hash:
de0f96468092aa02baf9bc0bdc5ae901
SHA1 hash:
f576575fc92797891a438c8ac42be0614af7630a
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/789983f4-9e5a-4780-ba1f-3cc785439636/
Parent samples :
ab2af768a15bf36f36de51389f4ee62cb0816779473a53716cee76734bda7538
090b0e38780c07da32a7d9119c754e34b398845b94fbe8ea544fc9ab8d81ac80
SH256 hash:
3624268b1bf67fd3f560f345e5171f3a2f8968a776c23816ea76fc0ef41b0f03
MD5 hash:
1619753b625e58c25b73fbf1f0bff482
SHA1 hash:
c0d7922bdbc10ef0ee1606a40c2dedd22cb180d4
Link:
https://www.unpac.me/results/789983f4-9e5a-4780-ba1f-3cc785439636/
SH256 hash:
12b13f5565dd51b51c8c43f12a911349212ff84036027e4959414d137b479124
MD5 hash:
e033020e6b884a52377e915ce192b3ee
SHA1 hash:
a690e03308f9d40bcf81fd7e0960bd14a81cd8c3
Link:
https://www.unpac.me/results/789983f4-9e5a-4780-ba1f-3cc785439636/
SH256 hash:
933a9da0db209b3f537753f43d87f1eadc3eccc0fd383ff1a9b55317aaa636ec
MD5 hash:
f6d2e804a559aec4cc38e814c6c3b73e
SHA1 hash:
7ffe54b7cce73ac25cf0508df6cb1619a771a32f
Link:
https://www.unpac.me/results/789983f4-9e5a-4780-ba1f-3cc785439636/
SH256 hash:
340ba2312d5cdfc3d89f3f35f627187dcb406e5afea134bc76b04f52f4285df3
MD5 hash:
85f9290aa8900e9fd74b01ee23125706
SHA1 hash:
310eb5e4aea5471b74a6385f1da283b9d8e3d698
Link:
https://www.unpac.me/results/789983f4-9e5a-4780-ba1f-3cc785439636/
SH256 hash:
ab2af768a15bf36f36de51389f4ee62cb0816779473a53716cee76734bda7538
MD5 hash:
3b61d04e555f74f42e22c71a5885ac71
SHA1 hash:
9c774e98b87394627d311a552d8bde85d57b327c
Link:
https://www.unpac.me/results/789983f4-9e5a-4780-ba1f-3cc785439636/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ab2af768a15b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/ab2af768a15bf36f36de51389f4ee62cb0816779473a53716cee76734bda7538

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/339552/

Comments