MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b10824c56d2ef6aa6af1474f898e5578bb6f6155eb4f9cd63ef3e7fd36c2a827. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b10824c56d2ef6aa6af1474f898e5578bb6f6155eb4f9cd63ef3e7fd36c2a827
SHA3-384 hash: b65d9d5bda7edd061e09c81278b7f681c654bbae987f66d081c1e88e5d1676737f0ec46e62d11775225ce493c6d4d680
SHA1 hash: 1df621e0616b6a0c2c5ec0acd2d27ec8ea72e097
MD5 hash: 3ebd21231dabb0ade99fee5da48309a2
humanhash: five-river-autumn-paris
File name:Scan 28837646737664829193848843 pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'222'144 bytes
First seen:2022-03-23 11:35:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:3ofi55DQ71qIGIwCMvtOqGuFtPqMFzLRtp7jmYpazdAk13m2YSpb:3Xk7yCLqVtH5Rv2Ttnn
Threatray 13'495 similar samples on MalwareBazaar
TLSH T18A45CF9C7650B5EFC91BCD76CA582C64EA2064BB530BE203A01715ADDE0EA9BDF150F3
File icon (PE):PE icon
dhash icon 6264dcfefefefcc8 (12 x AgentTesla, 4 x SnakeKeylogger, 3 x NanoCore)
Reporter malwarelabnet
Tags:exe FormBook xloader

Intelligence

File Origin
# of uploads :
1
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/256266/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/623b066edfdfa8501cd2c527/reports/234c396a-195c-42f4-9031-c0511c5fef84/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/963448
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 595928 Sample: Scan 2883764673766482919384... Startdate: 24/03/2022 Architecture: WINDOWS Score: 100 31 www.kioskpass.com 2->31 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 11 other signatures 2->45 11 Scan 28837646737664829193848843 pdf.exe 3 2->11         started        signatures3 process4 file5 29 Scan 2883764673766...3848843 pdf.exe.log, ASCII 11->29 dropped 57 Injects a PE file into a foreign processes 11->57 15 Scan 28837646737664829193848843 pdf.exe 11->15         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 15->59 61 Maps a DLL or memory area into another process 15->61 63 Sample uses process hollowing technique 15->63 65 Queues an APC in another process (thread injection) 15->65 18 explorer.exe 15->18 injected process9 dnsIp10 33 upoon81.com 104.161.44.5, 49779, 80 IOFLOODUS United States 18->33 35 www.lawajay.com 154.214.67.113, 49808, 80 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 18->35 37 4 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 svchost.exe 18->22         started        signatures11 process12 signatures13 49 Self deletion via cmd delete 22->49 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b10824c56d2ef6aa6af1474f898e5578bb6f6155eb4f9cd63ef3e7fd36c2a827/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 11:01:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=weecjrlnf33ku2xri5hytdsvpc5w6ykv5nhzzvr66pt72nwcvatq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01c73f71338af78f906544a2f2b1a685870d5ebc23903934af46e28c7886089e
Formbook
2bb47abc0ec7e4e48aa80d53e19056c6adbef6b1392b3816aa335364325870fb
Formbook
4892e9b8ed5aa57661e3a1fd4bc2d48570cd416af12ab88bbade473ede45c1ed
Formbook
6fb859be1f19ec66d032758b38eade770aedc4f60b2341284ff407647980852b
Formbook
b36891ab4a7fa6be1680a65614dd5551a3fa8a89052c381a954601eedd82e62c
Formbook
b7abbe227ce2d0bb2c611e6e5b67e220261a5f2218ef18b22e3a794789cb1bfc
Formbook
c68894e6a7551cdf34c082a0ba372f9544d07aee0f2d09dfb7fed3e664e91aaf
Formbook
ca77df966e202e0eab6d3c2280f95fb59aee28b5e9e540be3dca1d66c46bf2af
Formbook
d89f28603b8948dd7217e42366328a6e9bd05d59e5de67a4c39f207f8a520d43
Formbook
+ 13'485 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:ubqk loader rat suricata
Link:
https://tria.ge/reports/220323-nqkb3shecm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
d54e92129fe9926d2e995df71ecca40ba78e783dd22ba55d0f442a010b2f93da
MD5 hash:
5661ec0746d93b6ee0a2693f2e8a197e
SHA1 hash:
70cc5757db8ce3bcea5f830ca5b6e7ff72e62c31
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/8628047d-4146-418d-ae9e-a98561acc813/
Parent samples :
0e39ef64479fdca265d7a41809af208aa2720d8d3895187b5f8f7ea5370018bc
7de9f7a81557d4a2a6818b50b8f8ab8948ce6329bf1c696d038e1231237a07d0
041760471bc27a43bf84ff6bee7edce055983316c01cd984ade1872239c1a35c
b10824c56d2ef6aa6af1474f898e5578bb6f6155eb4f9cd63ef3e7fd36c2a827
SH256 hash:
abf8ee8d56b86ddaea64bab4aacdaaf0ce659edd43dcd0aa952d305529cec45f
MD5 hash:
df2f392117584aedceaff9d32a968b95
SHA1 hash:
e9b21681e4be6b4e84dbbe00dc8f05d408329eee
Link:
https://www.unpac.me/results/8628047d-4146-418d-ae9e-a98561acc813/
SH256 hash:
dc5c057b0ee1eb079cf189762aac69f0d86338ea18795dc4fbf7ed9b5a45c2eb
MD5 hash:
4103ed94f4747b30e166cf3c25416f47
SHA1 hash:
d553a67056e94f60d621ca42dcecd6d93f9ef1ad
Link:
https://www.unpac.me/results/8628047d-4146-418d-ae9e-a98561acc813/
SH256 hash:
852ffb740d6eaaf7b50d79f9bc83c8263b14223086affdbb7d89359e1fa27641
MD5 hash:
c89613b7e77ddbb884cf3fb25de7b0e2
SHA1 hash:
611ee7c8cfcc9db6535a8c1aa0f8e254ab3f21ac
Link:
https://www.unpac.me/results/8628047d-4146-418d-ae9e-a98561acc813/
SH256 hash:
b10824c56d2ef6aa6af1474f898e5578bb6f6155eb4f9cd63ef3e7fd36c2a827
MD5 hash:
3ebd21231dabb0ade99fee5da48309a2
SHA1 hash:
1df621e0616b6a0c2c5ec0acd2d27ec8ea72e097
Link:
https://www.unpac.me/results/8628047d-4146-418d-ae9e-a98561acc813/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b10824c56d2e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/b10824c56d2ef6aa6af1474f898e5578bb6f6155eb4f9cd63ef3e7fd36c2a827

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/256266/

Comments