MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb5cacda43fb28c636d1f0e628bd730cb7364305c8e91210c23a69ebbbf1e3a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments 1

SHA256 hash:	bb5cacda43fb28c636d1f0e628bd730cb7364305c8e91210c23a69ebbbf1e3a7
SHA3-384 hash:	f8b01a8a3cc78e9c6968919bb510367c622ba9d8bddf2e4383e5edbef8ce530b97f1750df5b9dee11b1423f42e1c3742
SHA1 hash:	5b1284a82a2e2357fd3fe6441519cc5f333eb767
MD5 hash:	8d62813dea222d240b0170fd581d97f4
humanhash:	sink-bulldog-two-lactose
File name:	8d62813dea222d240b0170fd581d97f4
Download:	download sample
Signature	Formbook Create hunting rule
File size:	440'832 bytes
First seen:	2021-09-30 18:29:00 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	6144:FXQ4kEjPDSFy3HNhbMwfq/xa4cLvHW/9vhFfU7bebEX3S48bcBQe3qBKSkSaG:6iNqx/xJqf+9ZFfU7i9Yz3qt
Threatray	8'317 similar samples on MalwareBazaar
TLSH	T1E294AE2617D54EA4C57CE779D3A181406BF0B4878343F3AFAE9115E65E233C26A2F227
File icon (PE):
dhash icon	0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

vbc.exe

Verdict:

Suspicious activity

Analysis date:

2021-09-30 16:42:40 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1050059b-ab90-47c7-b244-6452adcdeab6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/193773/

Detection(s):

SecuriteInfo.com.Trojan.MSIL.Noon.lc.14001.9440.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Malware family:

XLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/37661d12-7e5f-44f8-a17a-1a551fb0a545

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/862204

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb5cacda43fb28c636d1f0e628bd730cb7364305c8e91210c23a69ebbbf1e3a7/

Threat name:

ByteCode-MSIL.Spyware.Noon

Status:

Malicious

First seen:

2021-09-30 17:23:00 UTC

AV detection:

11 of 45 (24.44%)

Threat level:

2/5

Verdict:

malicious

Label(s):

formbook

Formbook

66e9a440c0e4719ed9c472be00302f7a1176f48b5e0153284abc0c8060d70306

Formbook

75772375acbcfb6cb668fc2449671a6a83afe1434184ac7c01fd895825fcf5e6

Formbook

77aaa556da2cd69f7351c8c146b75a14ffd0bb8d9dfc8428b18ea556e6d822bd

Formbook

870405a56054ca7d9b33c2b68d92be5db961bf51d8607f5b559404552229eb05

Formbook

87f8905d999f293634fddf1bff47a614041bdfaa2f07ef19fe70e5296a7b086e

Formbook

997e4e187d2a0cc4a6074189861cd11be4c812cd6145a0b4e4d9d292126b4327

Formbook

99a52f15cbd0ceb13b15070bbbab2eee59974d15e8d4aaed562b015d888294c5

Formbook

d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2

Formbook

ef68cb55157d9b985e30dedba705a141fb4a59f4d988bb873b4f5ad0623a7598

Formbook

+ 8'307 additional samples on MalwareBazaar

Result

Malware family:

xloader

Score:

10/10

Tags:

family:xloader campaign:hr8n loader rat

Link:

https://tria.ge/reports/210930-w4ww2aach4/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Xloader Payload

Xloader

Malware Config

C2 Extraction:

http://www.pochi-owarai.com/hr8n/

Unpacked files

SH256 hash:

bb5cacda43fb28c636d1f0e628bd730cb7364305c8e91210c23a69ebbbf1e3a7

MD5 hash:

8d62813dea222d240b0170fd581d97f4

SHA1 hash:

5b1284a82a2e2357fd3fe6441519cc5f333eb767

Link:

https://www.unpac.me/results/f3dca489-e266-4f03-8946-f4e9c428ee7c/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/bb5cacda43fb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/bb5cacda43fb28c636d1f0e628bd730cb7364305c8e91210c23a69ebbbf1e3a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

exe bb5cacda43fb28c636d1f0e628bd730cb7364305c8e91210c23a69ebbbf1e3a7

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1649373/

Cape

https://www.capesandbox.com/analysis/193773/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-09-30 18:29:02 UTC

url : hxxp://107.172.93.10/salt/bita.exe