MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb9d11dceeb51aac57dda9cd059c4449daacbe2bc7cdee5b6cb5320b41c4ee21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb9d11dceeb51aac57dda9cd059c4449daacbe2bc7cdee5b6cb5320b41c4ee21
SHA3-384 hash: 31c4b03906d87fed1c8453d1b03e1bfef82341803b7a879788bbac42435591ffbdf03605add31c169cd9d1ca1cad5571
SHA1 hash: 20fa7366c0abaa599095e2643a38b8746fea654b
MD5 hash: 3ca14e0edf2f47bd546f6a4e6327cebe
humanhash: apart-lion-helium-oxygen
File name:Filosofer.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:355'687 bytes
First seen:2023-05-18 14:10:38 UTC
Last seen:2023-05-24 05:53:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e160ef8e55bb9d162da4e266afd9eef3 (140 x GuLoader, 33 x RemcosRAT, 17 x AgentTesla)
ssdeep 6144:h4SUjhtXAxRJ2PGy9e5uv+c5H9ByjuGHK2Tb+w/z0FFtbSJPB7A9K2:6XA/gHv+c5HHyjO2nHqFtbSZBMv
Threatray 1'559 similar samples on MalwareBazaar
TLSH T1157413056FE745BFE0FE86701AB5EA3A83B4452D402534429354EFFA3C32DA78F56648
TrID 92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133)
3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
1.1% (.EXE) Win64 Executable (generic) (10523/12/4)
0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 6949e8ccd4e0e8e8 (4 x GuLoader, 1 x AZORult, 1 x Formbook)
Reporter JaffaCakes118
Tags:FormBook

Intelligence

File Origin
# of uploads :
6
# of downloads :
88
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Filosofer.exe
Verdict:
No threats detected
Analysis date:
2023-05-18 15:50:46 UTC
Tags:
installer
Link:
https://app.any.run/tasks/26fa384d-dae9-48ac-a0db-bc6c62b056ab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.23380.3503.10113.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Searching for the window
Sending a custom TCP request
Delayed reading of the file
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/bb9d11dceeb51aac57dda9cd059c4449daacbe2bc7cdee5b6cb5320b41c4ee21
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0701a477-04a3-4676-b4de-1f665e130211
Result
Threat name:
GuLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1236080
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 869078 Sample: Filosofer.exe Startdate: 18/05/2023 Architecture: WINDOWS Score: 100 35 www.wildhartbranding.africa 2->35 37 www.theguttercleaningservice.com 2->37 39 23 other IPs or domains 2->39 49 Snort IDS alert for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 7 other signatures 2->55 11 Filosofer.exe 1 39 2->11         started        signatures3 process4 file5 29 C:\Users\user\Bespiser\...\hgfs.dll, PE32+ 11->29 dropped 31 C:\Users\user\Bespiser\...\APM_AC3.dll, PE32 11->31 dropped 33 C:\Users\user\AppData\Local\...\System.dll, PE32 11->33 dropped 14 Filosofer.exe 6 11->14         started        process6 dnsIp7 47 globosphera.org 92.222.244.238, 49815, 80 OVHFR France 14->47 63 Modifies the context of a thread in another process (thread injection) 14->63 65 Tries to detect Any.run 14->65 67 Maps a DLL or memory area into another process 14->67 69 2 other signatures 14->69 18 explorer.exe 4 1 14->18 injected signatures8 process9 dnsIp10 41 fukuoka-h.com 113.43.208.223, 49844, 80 UCOMARTERIANetworksCorporationJP Japan 18->41 43 celarush.com 103.72.76.90, 49834, 80 TOMATOWEB-BDTomatoWebPvtLimitedBD Bangladesh 18->43 45 12 other IPs or domains 18->45 57 System process connects to network (likely due to code injection or exploit) 18->57 22 wlanext.exe 12 18->22         started        signatures11 process12 signatures13 59 Modifies the context of a thread in another process (thread injection) 22->59 61 Maps a DLL or memory area into another process 22->61 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb9d11dceeb51aac57dda9cd059c4449daacbe2bc7cdee5b6cb5320b41c4ee21/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2023-05-18 07:56:51 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
18 of 37 (48.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xoordxhowunkyv65vhgqlhcejhnkzprly7g64w3mwuzawqoe5yqq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4
Formbook
3d08ef8c047e8dbe3fcc4006acfd53b2b40fc9e02fef110884b1923ff067c69c
Formbook
40af7ea5c438a5e5d39e726925d6ce11eadb0438f7dcaa50e753e7bb393f6775
Formbook
41618cb3eabd9750fa776f31b8117e4025fd3d03af5e30d62100d84ce8101406
Formbook
8848260baf85d9da96dcabdb756b5ac0fd6449361ad497d6e68a81cfe8565aad
Formbook
9bdc185c4c52ab97921a7d99b7bfe6e22ac5be828d999b19e41983b3c79af0c9
Formbook
af2338dccdb59d40b3e6fbde008f3fad793ae9910fc3f2210bf6e9a311bd8044
Formbook
e29c4da2ffb29da2ca94953e638058674b6234ac0c75864d644a661d582a3ab1
Formbook
ee06ec93a5853e2753e8c758fda076944b7cb7cc657fb249b03d28cbc45db077
Formbook
f45ed09f500667f7fbae32453fa1464a6003dc9ef3be284e156a43bacd3c2147
Formbook
+ 1'549 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:guloader campaign:bb27 downloader rat spyware stealer trojan
Link:
https://tria.ge/reports/230518-rhf68scc94/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Loads dropped DLL
Formbook payload
Formbook
Guloader,Cloudeye
Unpacked files
SH256 hash:
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 hash:
a436db0c473a087eb61ff5c53c34ba27
SHA1 hash:
65ea67e424e75f5065132b539c8b2eda88aa0506
Link:
https://www.unpac.me/results/460ea580-cb06-4e7b-b46c-ac10e53305bd/
SH256 hash:
bb9d11dceeb51aac57dda9cd059c4449daacbe2bc7cdee5b6cb5320b41c4ee21
MD5 hash:
3ca14e0edf2f47bd546f6a4e6327cebe
SHA1 hash:
20fa7366c0abaa599095e2643a38b8746fea654b
Link:
https://www.unpac.me/results/460ea580-cb06-4e7b-b46c-ac10e53305bd/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bb9d11dceeb5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bb9d11dceeb51aac57dda9cd059c4449daacbe2bc7cdee5b6cb5320b41c4ee21

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments