MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 13

Intelligence 13 IOCs YARA 22 File information Comments 1

SHA256 hash:	adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c
SHA3-384 hash:	58d9b963fc890a8cf9c8870d95adf885d0329d3ccb0c6f16f927849e0cb0fbf589ba67f7d0233d23183d5f94de7edb05
SHA1 hash:	b005e60a82d606a7e73c1f01782962a655fb97e9
MD5 hash:	cb38f35ebcddff1cb735acad8b65096e
humanhash:	winter-timing-xray-violet
File name:	cb38f35ebcddff1cb735acad8b65096e
Download:	download sample
Signature	Formbook Create hunting rule
File size:	496'128 bytes
First seen:	2023-08-13 01:52:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:AlV6CYmwEodwPVwj40IfLLBRiOvZ8B98C+xCD22jISYUL:+oiPiFY94OhO99gCy20x+
Threatray	3'550 similar samples on MalwareBazaar
TLSH	T1E6B45BE0317D93CBD0A18DB14FCA4A7075F136AC98D5970D60F69B2E93D6395088C6EE
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	d4a6a494a48484a4 (65 x AgentTesla, 39 x Formbook, 8 x RemcosRAT)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

294

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

özellikler.xls

Verdict:

Malicious activity

Analysis date:

2023-08-10 14:50:41 UTC

Tags:

opendir exploit cve-2017-11882

Link:

https://app.any.run/tasks/6a973976-6fa6-4134-87c0-1a530253d49b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/442415/

Detection(s):

SecuriteInfo.com.Trojan.InjectNET.50.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Сreating synchronization primitives

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

confuserex packed packed

Link:

https://www.filescan.io/uploads/64d8377e4154db2bd52a1409/reports/f75ff039-9901-4c23-b577-ffac2b5a1882/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9e61b579-d494-43ac-ac50-656d6c55bfdb

Result

Threat name:

zgRAT

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1290552

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2023-08-10 18:02:19 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 38 (60.53%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vx2mu2mwaqxlcdrmwrvxfxlh2vsa4mgjiw4q5gw4r5rhgmhynega._file

Verdict:

malicious

Label(s):

formbook

Formbook

5348bcccead193b46acc11339b9c3ff05395753d536a0952641af34382e08604

Formbook

6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1

Formbook

72d3a95a59ccd8220e04850fb54fdc48caa51c10739d96afa48ab5446303dc07

Formbook

8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d

Formbook

9e9af76a8585a7b99a59f042f64a711aaa8f9bfb68a4040ca522147470d6b6de

Formbook

c7616a546f8e22dd0a80b275f5991b6c6ab567d278be339904d6bff0c5c00a42

Formbook

fed8358d2eb6cd687bb6f6a88b4f8bc01bd5dcf355535532718a0f04f1eff674

Formbook

+ 3'540 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/230813-cayzragd52/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Unpacked files

SH256 hash:

341600e5fe8f53faf04eadc6390e471dc2444ab28691514af8b74c8b561d9a5b

MD5 hash:

67663152c1f736896ce8322eafc835ff

SHA1 hash:

4820664daf28d13d8c9ca922fd86d46c6eb7bff1

Detections:

XLoader

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/794c9926-a1d5-4ca9-bc12-6cec731688cf/

Parent samples :

8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
fed8358d2eb6cd687bb6f6a88b4f8bc01bd5dcf355535532718a0f04f1eff674
c7616a546f8e22dd0a80b275f5991b6c6ab567d278be339904d6bff0c5c00a42
9e9af76a8585a7b99a59f042f64a711aaa8f9bfb68a4040ca522147470d6b6de
72d3a95a59ccd8220e04850fb54fdc48caa51c10739d96afa48ab5446303dc07
5348bcccead193b46acc11339b9c3ff05395753d536a0952641af34382e08604
20d45ab8062d59db6229e293a604f37e2760519894d07380288f0f8f5e2b5c95
adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c
a0c810baccbd3943748568d16e5b9cdf6b829364c8e4b21cda09c4f865b228f0
5e0519cad57279ab39f475c7ec22d2435a4a69f2378cf2254745e089f5c174fb
8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381
31fd5ab4ff38fd42399d4d90a19da71b94cd7ba47b0a97ce1bda37958ce97ef6

SH256 hash:

78eaae7f782e4b12d7d47f290ddaae74c19373393bb86673fb25633b7fcbc7c9

MD5 hash:

be26954f9951b84a519797424fc52ee1

SHA1 hash:

8228036eb552bf7679f37cbd463d3f911d29964e

Link:

https://www.unpac.me/results/794c9926-a1d5-4ca9-bc12-6cec731688cf/

SH256 hash:

ccf4bff46d21529c3d80c09e62caa7d98a827a911c27b1e1162cd2ae63df5688

MD5 hash:

38011802c816427832469aa74d80874d

SHA1 hash:

55e76a39493785b8c7d90dc1f2acb1fa7b311735

Link:

https://www.unpac.me/results/794c9926-a1d5-4ca9-bc12-6cec731688cf/

SH256 hash:

adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c

MD5 hash:

cb38f35ebcddff1cb735acad8b65096e

SHA1 hash:

b005e60a82d606a7e73c1f01782962a655fb97e9

Link:

https://www.unpac.me/results/794c9926-a1d5-4ca9-bc12-6cec731688cf/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_zgRAT Create hunting rule
Author:	ditekSHen
Description:	Detects zgRAT

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_Formbook Create hunting rule
Author:	@malgamy12

Rule name:	Windows_Trojan_Formbook_1112e116 Create hunting rule
Author:	Elastic Security

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.formbook.

Rule name:	win_formbook_w0 Create hunting rule
Author:	@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

exe adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2704174/

Cape

https://www.capesandbox.com/analysis/442415/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-08-13 01:52:50 UTC

url : hxxp://103.16.225.211/W098T/wininit.exe