MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf47f08eee3ae55a05d7cc1609a916422eb04771d04242ffa60756d922df3412. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf47f08eee3ae55a05d7cc1609a916422eb04771d04242ffa60756d922df3412
SHA3-384 hash: 37440128367d8a2b98a568eb618d7182abad0e99c0eae6b46b44755bec7eb43f4f036f59ce9308c1d9dae8d6817de274
SHA1 hash: c92ba872e6526cf29671417aeae854da3d1719b0
MD5 hash: 1d61790bf5130b905abcad46308956ef
humanhash: victor-yankee-may-william
File name:1d61790bf5130b905abcad46308956ef.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:773'120 bytes
First seen:2021-08-31 08:47:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:dRkD1c8cDjU2DZOy0lQRrVm1eoXiHRsB9Xy:Lm2DZpR1OeoSH
Threatray 8'887 similar samples on MalwareBazaar
TLSH T1E4F43D7F19BDA2278175C6F58BE78827F0108B6F3110696476D347264322A7AB4F336E
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1d61790bf5130b905abcad46308956ef.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-31 09:08:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/def4ddab-a6c3-4982-9377-2c5fbe2f991e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/184074/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2813a6ea-5543-44ab-8a98-fdcb9e117536
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/842441
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 474875 Sample: XKE3fs2ovD.exe Startdate: 31/08/2021 Architecture: WINDOWS Score: 100 35 www.autoschapin.com 2->35 37 clientconfig.passport.net 2->37 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 8 other signatures 2->47 11 XKE3fs2ovD.exe 3 2->11         started        signatures3 process4 file5 33 C:\Users\user\AppData\...\XKE3fs2ovD.exe.log, ASCII 11->33 dropped 59 Tries to detect virtualization through RDTSC time measurements 11->59 61 Injects a PE file into a foreign processes 11->61 15 XKE3fs2ovD.exe 11->15         started        18 XKE3fs2ovD.exe 11->18         started        20 XKE3fs2ovD.exe 11->20         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 22 explorer.exe 15->22 injected process9 dnsIp10 39 www.fmldldlfdflref.com 22->39 49 System process connects to network (likely due to code injection or exploit) 22->49 26 WWAHost.exe 22->26         started        signatures11 process12 signatures13 51 Self deletion via cmd delete 26->51 53 Modifies the context of a thread in another process (thread injection) 26->53 55 Maps a DLL or memory area into another process 26->55 57 Tries to detect virtualization through RDTSC time measurements 26->57 29 cmd.exe 1 26->29         started        process14 process15 31 conhost.exe 29->31         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bf47f08eee3ae55a05d7cc1609a916422eb04771d04242ffa60756d922df3412/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-31 07:44:50 UTC
AV detection:
12 of 37 (32.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5d7bdxohlsvuboxzqlatkiwiixlar3r2bbef75ga5lnsiw7gqja._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
6da5af0a0601c6ad4b492ed60b8e08d2fbb2858b862a7b67a26845d8cea92734
Formbook
7c6393b4e86ea5cec49c0f814b17e4bb85aa447c19896037252a94ff6416ce1b
Formbook
7ff8da221f76a27a09d3cf6be17e7f40cf74c98fc8513ec8dc5d72ee34e75a5e
Formbook
8ac1fc19367861f3a749d801300f554148e36a0e8a4f4cce3c5d3e4de43e4279
Formbook
8d1770889689f693a9029f4f36a590297a38ef96cf606fa0b9cfd6a981b547d0
Formbook
96d01352b8291a658a602d403e2133d469945ab385d9746db535aba474fc04d0
Formbook
a2cdf452f83aa86c0f3ade321cfc00a9ed3671082372081a67cad84a26492051
Formbook
dd44eb26a328f1e86823339666e1b1237ad7b1d880694c1b8fb8164b931aa512
Formbook
e2e5850cea576bbc3c39a1e652f6c35e22229ab04ae734c5c7512b9ac3955964
Formbook
ecacac4e9f514e780ff7124b6fdd97251dcec9947d5815166b2b57d2a41ddf0e
Formbook
+ 8'877 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:bckt rat spyware stealer trojan
Link:
https://tria.ge/reports/210831-z9l9dn67ye/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.wonderspirits.com/bckt/
Unpacked files
SH256 hash:
bd39c62e454bea953bfb1da37b102d7758a487fbf10ba126368d52d0edf6ef84
MD5 hash:
eee6db77469f8bd29389645188ec1a5e
SHA1 hash:
34a81c7627e1cd505b953c41dcca3d39d6752684
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/afb73add-a6b4-41dc-8878-905aaacd3c56/
Parent samples :
96d01352b8291a658a602d403e2133d469945ab385d9746db535aba474fc04d0
bf47f08eee3ae55a05d7cc1609a916422eb04771d04242ffa60756d922df3412
c44b1ee1b7cd66260ed15839ebaa8fc97be83e5b61007a14384f86e14ecf4a20
7d6cb8f7f367c80349027eada7707f57f758aa3ba31fc4889f6f8bec5ff47cab
c474dc9d81e08842f527487d032551b0d86e95a0f32fa2ebc7375fdb740c7e42
938bf878a5a507a424718a7302d55d36c1ae58fcf571c5da0a6a4a136ee0f736
12ebeef2321e3a83ede052c45399620ea7227ffaf55e5219895b30df19f97177
4e574ffdb3aba06f7e3aaebd9293eaf171289304e7fdd8ecfbf8275a149eba1d
SH256 hash:
c0ee1071e444f415f8b62856a0896f3b22e563f1bb4f03d14142583efe49a565
MD5 hash:
29db2e114b88ae1f6a00c9aa71690043
SHA1 hash:
ec82db71443556a5b320357b0b8b09e70ec1db9c
Link:
https://www.unpac.me/results/afb73add-a6b4-41dc-8878-905aaacd3c56/
SH256 hash:
205b4bf3c729ac04e09675b7505fa3beab10e7e4e78edaef80d4d8d94d1e4c7b
MD5 hash:
354339673a489ee008ca5ab2c3e7b891
SHA1 hash:
6e73aad65b4bf2be58e3005391685a02493a6b51
Link:
https://www.unpac.me/results/afb73add-a6b4-41dc-8878-905aaacd3c56/
SH256 hash:
bf47f08eee3ae55a05d7cc1609a916422eb04771d04242ffa60756d922df3412
MD5 hash:
1d61790bf5130b905abcad46308956ef
SHA1 hash:
c92ba872e6526cf29671417aeae854da3d1719b0
Link:
https://www.unpac.me/results/afb73add-a6b4-41dc-8878-905aaacd3c56/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/bf47f08eee3ae55a05d7cc1609a916422eb04771d04242ffa60756d922df3412

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe bf47f08eee3ae55a05d7cc1609a916422eb04771d04242ffa60756d922df3412

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1577492/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/184074/

Comments