MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd6590ea8487980b0112c720b40de84c880d57a2f35e8488b7a41f8d506e4b3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd6590ea8487980b0112c720b40de84c880d57a2f35e8488b7a41f8d506e4b3a
SHA3-384 hash: 3170c27e272818c97233f87c72394ca24b517168d5a91c0a93c781c6ded550c2d3e82fa60c819e0c33b1bb5fc2bdece1
SHA1 hash: a2fa7c23c5a519aee69cc8253e570842ec9c9c53
MD5 hash: 2a936923728f5fd2ec1b5f939de46120
humanhash: delta-utah-speaker-solar
File name:SecuriteInfo.com.Trojan.GenericKDZ.72843.13744.14209
Download: download sample
Signature Formbook
Create hunting rule
File size:1'012'224 bytes
First seen:2021-02-04 11:44:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:uYVnqipAhZv3eu4zV8nHCdoHaPyLx7EUbOF0nL2PF/q5QejZo:uYVqewI6nib6LVzb+FJqNo
TLSH AC25E0222399EF58D03D67794068D13093F1A816EB36C7AEFED194DF2D65F82871A302
Reporter SecuriteInfoCom
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SPARE PARTS Drawing.xlsx
Verdict:
Malicious activity
Analysis date:
2021-02-04 01:32:13 UTC
Tags:
encrypted exploit CVE-2017-11882 loader trojan formbook stealer
Link:
https://app.any.run/tasks/83cb3ab2-1b99-4f56-9aa5-60afb354917c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115562/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.72843.13744.14209.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/599299
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bd6590ea8487980b0112c720b40de84c880d57a2f35e8488b7a41f8d506e4b3a/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 05:47:37 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader loader rat spyware stealer trojan
Link:
https://tria.ge/reports/210204-6v9gm8hv16/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Formbook
Xloader
Malware Config
C2 Extraction:
http://www.classifoods.com/oean/
Unpacked files
SH256 hash:
2b2bcf851c2b87033fd24c890c2a1de3642564f7cec7282982d96b8280baa849
MD5 hash:
befb0470c71d676cc891cba16088975d
SHA1 hash:
5b7143f97d1d656fd1cacf70949048c1951b639a
Link:
https://www.unpac.me/results/8fb95752-676e-4097-88b8-b330b304f0ad/
SH256 hash:
290bd2c26bcde7e93fe1f64d6b5d5f3a7d3460499e63fb90ae6cf9e8680c71cc
MD5 hash:
c1e2216afa2750949a06f3e1b7b468b1
SHA1 hash:
bfbd33afee9754b64716ecaee69c9e2c28f7bbe9
Link:
https://www.unpac.me/results/8fb95752-676e-4097-88b8-b330b304f0ad/
SH256 hash:
9150693ac3c1398300577d323097e0fbffd9624986c07ad77657a848bdb58221
MD5 hash:
668d780b83ab14a278561d4abdd2339c
SHA1 hash:
89b92401e32fb4f0fc943c24f6512f028883034a
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/8fb95752-676e-4097-88b8-b330b304f0ad/
Parent samples :
dca4c9a7846a3ebb066c08583388adeb4b05e464f20abd10409ccf47164d8635
a21da47756a5b8a820ac633dcc6902b2ca4b9dd0861741f8f68153e5c436bda5
43240f1dfbde94a0fb438b295e6ddb3ef5aa5ef82f42222312f2eb49b91f9de8
e49c51a6864bf50e27baca58c5a2420046cae1803c5e0338af152b50d0dcc215
4852c82f847938224365300b4fa89e8b3921e3b9d37f2c2b75605184f81ea9d2
82809ddcfce7489cd7b3c92abf7a4f8d4cc3a0b7b98f03712b7828c24d823b80
7d415eefddcae0169dea43f7979b50ff6c8e514efe9d204e7822621bbd26ffde
fd3450b3f8973200c17fb786110c7a8f7c6994833137ca37322355d1ab9c8e82
6ceed0880cf4e6861ae894331beef85274f7f6a3f8dbc19d4a5f4e41b239439e
4296017b65ad648a9722bd35d3446c4adffaf9ccbd5c603d25325f0fd8a8d343
e8e6f1a8298545d8f56516375149c109f201c94738af99e65e4df71727d52d32
bd6590ea8487980b0112c720b40de84c880d57a2f35e8488b7a41f8d506e4b3a
SH256 hash:
bd6590ea8487980b0112c720b40de84c880d57a2f35e8488b7a41f8d506e4b3a
MD5 hash:
2a936923728f5fd2ec1b5f939de46120
SHA1 hash:
a2fa7c23c5a519aee69cc8253e570842ec9c9c53
Link:
https://www.unpac.me/results/8fb95752-676e-4097-88b8-b330b304f0ad/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bd6590ea8487980b0112c720b40de84c880d57a2f35e8488b7a41f8d506e4b3a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe bd6590ea8487980b0112c720b40de84c880d57a2f35e8488b7a41f8d506e4b3a

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/115562/
  
URLhaus
https://urlhaus.abuse.ch/url/990136/
  
Delivery method
Distributed via web download

Comments