MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ade283e1dc7b88a52ca2c0ac149af10ff68dff1709a27dd800936a7345cc6b56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ade283e1dc7b88a52ca2c0ac149af10ff68dff1709a27dd800936a7345cc6b56
SHA3-384 hash: 36a2dbf024d094efe6f2fc24c6585a8448d0847c4842103381e3899d6e94c769b6a13519e834bbb9ce48dfbbf53f32b1
SHA1 hash: 678048ad55418587075d1df6c91eade66823de2f
MD5 hash: 708e2d6b2b59ddeb88fb051ccf3869c6
humanhash: oregon-montana-nitrogen-emma
File name:triage_dropped_file
Download: download sample
Signature Formbook
Create hunting rule
File size:5'921'792 bytes
First seen:2022-05-16 11:43:56 UTC
Last seen:2022-05-16 12:51:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 49152:qEaH7/7iK4n1b5oe0GdKxMufW4DC/j0ThnEQAGeNDPAvuzWtAvuzWtAvuzWtAvuj:RndVfP
Threatray 15'235 similar samples on MalwareBazaar
TLSH T1175612117E685A15D8EE373AE3E21C092BF594A31661C49E7F5E27C20563703ED2B33A
TrID 61.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.0% (.SCR) Windows screen saver (13101/52/3)
8.8% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter malwarelabnet
Tags:exe FormBook xloader

Intelligence

File Origin
# of uploads :
2
# of downloads :
222
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f1c61aa948a4c4c5700fc20c0050ef5960c8a5c08b7168bc555fa13e9809ade6.xlsx
Verdict:
Malicious activity
Analysis date:
2022-05-16 06:20:32 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/afa2dbd4-c67d-489e-92cd-1685850f4f5d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/271069/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Adding an access-denied ACE
Launching a process
Searching for synchronization primitives
Reading critical registry keys
Creating a file
Launching cmd.exe command interpreter
DNS request
Sending an HTTP GET request
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
msbuild.exe obfuscated
Link:
https://www.filescan.io/uploads/628239430076642c5950cf25/reports/57862e05-9ddf-4c43-af68-9336b98b662b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ccb3b2b4-f4f3-4766-9dd6-bf90c5134915
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/994861
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 627360 Sample: triage_dropped_file Startdate: 16/05/2022 Architecture: WINDOWS Score: 100 31 www.byzbh63.xyz 2->31 33 ytc5axd6.n.cnamexingzuoy.com 2->33 35 2 other IPs or domains 2->35 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Antivirus detection for URL or domain 2->41 43 8 other signatures 2->43 11 triage_dropped_file.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\...\triage_dropped_file.exe.log, ASCII 11->29 dropped 51 Writes to foreign memory regions 11->51 53 Injects a PE file into a foreign processes 11->53 15 charmap.exe 11->15         started        signatures6 process7 signatures8 55 Modifies the context of a thread in another process (thread injection) 15->55 57 Maps a DLL or memory area into another process 15->57 59 Sample uses process hollowing technique 15->59 61 2 other signatures 15->61 18 explorer.exe 15->18 injected process9 process10 20 cmd.exe 18->20         started        signatures11 45 Modifies the context of a thread in another process (thread injection) 20->45 47 Maps a DLL or memory area into another process 20->47 49 Tries to detect virtualization through RDTSC time measurements 20->49 23 cmd.exe 1 20->23         started        25 explorer.exe 105 20->25         started        process12 process13 27 conhost.exe 23->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ade283e1dc7b88a52ca2c0ac149af10ff68dff1709a27dd800936a7345cc6b56/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-05-16 03:39:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
15 of 26 (57.69%)
Threat level:
  1/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1fa17f6996cc7efdabe3099d0543ec457cff4f54d246c089d6d7dd8e72eee1c9
Formbook
387234df5ff2369a1a2bd25b060d5d7dd3817e07577baadd33bdf5c2dc7725c1
Formbook
4ac982ea35522a13de30ff7ddbbec9becf2c7528a48f0aff377e3d6758a7ae7b
Formbook
bea7dde650c823aa2887bc7065abd818c02e573c041ea69c1ea60c43fe1a79df
Formbook
c1784c72cf689294811cf3f79a5b05a42207842e718bc1a3a2d40fa80d876ff8
Formbook
d7dc569e0cf8cc6afc0a4a922263195ea12051b1db428fcf9fba724d90261a5e
Formbook
eba97a314b1c02ecdd75fe691c6883b214dc0b239d0ba39b7d578162b5218ad0
Formbook
f156099a9282dcdcab3acbf57c50bc1d0121a6e9714d43ba69ab9934ab0d9439
Formbook
+ 15'225 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader campaign:arh2 loader persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220516-nv5tkscfcj/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Drops file in Program Files directory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Adds policy Run key to start application
Executes dropped EXE
Xloader Payload
Formbook
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Unpacked files
SH256 hash:
f00f250f63b462fa6bf7557324616eb67b45b5644edfdf89e77121af9e7fd7ec
MD5 hash:
071f8a09b8eb2e3edabccdeda8b52c7a
SHA1 hash:
2b6f6b917d9cce91d06708dadc42d823259a5012
Link:
https://www.unpac.me/results/1fb2e3a6-a6c1-4658-b179-3736098e708a/
SH256 hash:
70b785e5cb5b2e61c0f5da4a71ab0bbd14d9a0849387f037e0d75cc1ffe0a082
MD5 hash:
5951b52c9b4d11ca7f4f33e5a3fb2c31
SHA1 hash:
0bc54fd699fff7b93e5c447a141c0d904924ab0d
Link:
https://www.unpac.me/results/1fb2e3a6-a6c1-4658-b179-3736098e708a/
SH256 hash:
ade283e1dc7b88a52ca2c0ac149af10ff68dff1709a27dd800936a7345cc6b56
MD5 hash:
708e2d6b2b59ddeb88fb051ccf3869c6
SHA1 hash:
678048ad55418587075d1df6c91eade66823de2f
Link:
https://www.unpac.me/results/1fb2e3a6-a6c1-4658-b179-3736098e708a/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ade283e1dc7b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/ade283e1dc7b88a52ca2c0ac149af10ff68dff1709a27dd800936a7345cc6b56

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/271069/

Comments