MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
SHA3-384 hash: 5748cc7ba3b7b77c9f899bbe6e7ba151645684171efc6e43e7e14655c04fe235a974f2870708d39b70ae517ec9bf0fd3
SHA1 hash: be9dddd5fac8482212030b5f6cbb04f1190a6113
MD5 hash: c35b8d27f7ed050e3bc31e536a0e389f
humanhash: lion-avocado-florida-green
File name:c35b8d27f7ed050e3bc31e536a0e389f
Download: download sample
Signature Formbook
Create hunting rule
File size:841'728 bytes
First seen:2022-02-18 11:47:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:TbZZMwO7ATyN3Og9QBHbel3qs5M8Q6W3C:T0l78zp8RQ
TLSH T1D505AE1631EF5442C362EAB24FD9ECBF87ADF177220EB53931C52B568722A509D023B5
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
248
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://107.174.138.201/588/vbc.exe
Verdict:
Malicious activity
Analysis date:
2022-02-18 15:58:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4161e97b-6822-4140-ae59-9f8667bd1d5e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/242527/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.57439.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/620f877aac8ad0468b50abd7/reports/be9de76e-6f2c-4e6c-a5c7-3a353cf824bd/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b036a0d9-f4f8-4667-ad95-473f5960eb77
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/942185
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 574661 Sample: 8N6y3SJDB7 Startdate: 18/02/2022 Architecture: WINDOWS Score: 100 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus detection for URL or domain 2->23 25 8 other signatures 2->25 6 8N6y3SJDB7.exe 3 2->6         started        process3 file4 17 C:\Users\user\AppData\...\8N6y3SJDB7.exe.log, ASCII 6->17 dropped 9 vbc.exe 6->9         started        11 vbc.exe 6->11         started        13 vbc.exe 6->13         started        15 2 other processes 6->15 process5
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-02-18 11:48:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zdp53vgf22zml3r4j52gkftt42lvysxalv5ozygarzamflms3n7a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:vy44 rat spyware stealer trojan
Link:
https://tria.ge/reports/220218-nyfnvscea2/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Formbook Payload
Formbook
Unpacked files
SH256 hash:
e33254e2ad4d279914a29450f98d1750a9f513fc8ddb853e0dd8346b805faa43
MD5 hash:
b597cce7bfc65e56fa69ebb7f413a33f
SHA1 hash:
7ee40df5ac783432e7c9f7be4f7ed1f286345d58
Link:
https://www.unpac.me/results/eef1ff5e-8c21-41b2-b17d-7739b4daf22d/
SH256 hash:
01c7bf5835ada794ffb97b0b0a89d7896d98e7242845262551ccd01610ebb5e7
MD5 hash:
d1cb8df62051d57baf4bc31925f9d841
SHA1 hash:
b46d650c962f761787d6295039734836a08aa77a
Link:
https://www.unpac.me/results/eef1ff5e-8c21-41b2-b17d-7739b4daf22d/
SH256 hash:
2d0073efbb5294178299b30e0347a6ca0a6bfcd98ccc463338417d3fc615e4b5
MD5 hash:
be562d0bfb918cdba9a50887ad551e38
SHA1 hash:
e3025c805c79edac519fcd6ce0c64c57e528f406
Link:
https://www.unpac.me/results/eef1ff5e-8c21-41b2-b17d-7739b4daf22d/
SH256 hash:
7a9082e58b4c5f706686494af548c28c91b0d6b023c64ba850098dff87943591
MD5 hash:
ad7eca731b77353ea6fa2ceefb3d051d
SHA1 hash:
23027f153c665a249f7b2c57c034fa690999a447
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/eef1ff5e-8c21-41b2-b17d-7739b4daf22d/
Parent samples :
921628eeb649a7c9f45ccb4b95ccecba8a76e273a88bdf8478c7e63cef2fb10a
c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
bcb97b3cbfe72dac8416a224ddb03a17ccba79da52872c6f5fcb13b93b43a247
d30c20e0685764513feb26aec0cddb5040a2d50d4f65cf1872349d7b852f55ac
SH256 hash:
c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
MD5 hash:
c35b8d27f7ed050e3bc31e536a0e389f
SHA1 hash:
be9dddd5fac8482212030b5f6cbb04f1190a6113
Link:
https://www.unpac.me/results/eef1ff5e-8c21-41b2-b17d-7739b4daf22d/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c8dfddd4c5d6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2047532/
Cape
Cape
https://www.capesandbox.com/analysis/242527/

Comments


Avatar
zbet commented on 2022-02-18 11:47:42 UTC

url : hxxp://107.174.138.201/588/vbc.exe