MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9ce6cdd55466893068a0f0b4f6b0ea2e96ca3f7d55f818bda2205985037ac0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9ce6cdd55466893068a0f0b4f6b0ea2e96ca3f7d55f818bda2205985037ac0a
SHA3-384 hash: 536ffcd8426ed8eb5c666eca882de35a3f313bd519642edba26a0e75c45909d3edae79c473f677c819095da3bd926a5f
SHA1 hash: 1464d4e2b26a84a7a3a0f4bff81cc29f1a728e47
MD5 hash: 05b6cd41d00058638993f804a19daea9
humanhash: hot-ack-fruit-one
File name:SecuriteInfo.com.Variant.Strictor.272734.13476.3027
Download: download sample
Signature Formbook
Create hunting rule
File size:1'008'128 bytes
First seen:2022-05-18 17:47:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:i5BV2x/5Lc8ykG0vIw3hpZBHp6QeSLLID:i2c8IwrZilSLL
Threatray 15'584 similar samples on MalwareBazaar
TLSH T11325AE98F240E99FC8378D32C5344C70A2606DE696F7D207A097399D79FE69F8E105A3
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 514444594d55516d (3 x Formbook)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
254
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Strictor.272734.13476.3027
Verdict:
Malicious activity
Analysis date:
2022-05-18 20:48:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b67c571e-f0af-438e-9e0c-0e0368264205

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/272193/
Detection(s):
SecuriteInfo.com.Variant.Strictor.272734.13476.3027.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62853137fd71ca8b2ef14c0a/reports/52273ad1-3025-4012-a4bd-80c1f25e4903/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/41eae715-c1bc-4cfc-ae56-6164227485cb
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/997085
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c9ce6cdd55466893068a0f0b4f6b0ea2e96ca3f7d55f818bda2205985037ac0a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-18 17:48:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
15 of 41 (36.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zhhgzxkvizujgbukb4fu62youluwzi7x2vpydc62eiczqubxvqfa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
49f94b3fbaf875cb2c223cdee59cfdedf4b2b937fba4a473cf2e4f767b44cb4c
Formbook
67435ee3c6fd3d272c004256f34020df37fb93fd33c18720053b9d2c1bb19b67
Formbook
8620dfa9694ab0983c78573f6a5d3b6a9eae06907282c6ad4ca84fa7d1b79b98
Formbook
898b47cb2e4d16a7325de16aae14c3c66894467ece923e706c186ee9ab75799b
Formbook
8e2fa281cc72512de1fc53eb27a9c04a524ce87c3cdf5932931ea3dc463a459a
Formbook
9c6a6119bc7008246685cb9960fe21969a8bfbbea6659e6e0afa329358c60a50
Formbook
c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
Formbook
da30dd86e912cbfcf0cb4306265cedf47604891dc868db7c59dd92d47ad32063
Formbook
da90895ec14c13c733ba3550194ab36a4c64130c5c2b2038c163dff0c505b3e3
Formbook
+ 15'574 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:gfge loader rat
Link:
https://tria.ge/reports/220518-wdevtscda2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
b7f01ac14350b7644caff31902dd801757ec7c468dadb86f0283329635140064
MD5 hash:
c35e0f7b3802d97501727c57d9054d9c
SHA1 hash:
72809a3885a155339ac93cf750ac05d367d89c5c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/6e4bf3f8-5514-4333-9ba8-dcd29b027baa/
Parent samples :
a997b6a541b763d9a2efe9e00e5d06facbe23471bbca2b19f30c8126c93bc101
c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
abb7b79496780a03680d3406348b02a7418a75260a97ad3a63a9c0d11d030488
c9ce6cdd55466893068a0f0b4f6b0ea2e96ca3f7d55f818bda2205985037ac0a
ced900f9ec05901373c3ae09a06b3ef5ef958764f1fc551590b5f2a820f115a1
3946f3036e103af4caf04607d09ead4968fc0240881596f5e95db307f260d898
SH256 hash:
b9af97b3ffc556a97d7cee71f850c2a99b2d5f5372bff3f7fb9f5857b9cd7e47
MD5 hash:
cc4f5dd05b463fda1b16a55b9b25d286
SHA1 hash:
ce6cb6124b24e27d90e3d8831a5ceb4370cc2b62
Link:
https://www.unpac.me/results/6e4bf3f8-5514-4333-9ba8-dcd29b027baa/
SH256 hash:
78cd01a994c86b5bab78efbdb52d4f128f66be1f85ee8b707c27664907e50e47
MD5 hash:
0a61f44a9f1a40ae92c01a56386b1183
SHA1 hash:
c9316294fe1092b55868d76ef9b791166b21dd8a
Link:
https://www.unpac.me/results/6e4bf3f8-5514-4333-9ba8-dcd29b027baa/
SH256 hash:
09602efe05dc6b9738b23b91708978231d20c08329940541a086561795a6c9fd
MD5 hash:
1521132bd568891debf24b4973aaa24e
SHA1 hash:
393fafe43a177d02d2a8be164101fc2add2748dc
Link:
https://www.unpac.me/results/6e4bf3f8-5514-4333-9ba8-dcd29b027baa/
SH256 hash:
c9ce6cdd55466893068a0f0b4f6b0ea2e96ca3f7d55f818bda2205985037ac0a
MD5 hash:
05b6cd41d00058638993f804a19daea9
SHA1 hash:
1464d4e2b26a84a7a3a0f4bff81cc29f1a728e47
Link:
https://www.unpac.me/results/6e4bf3f8-5514-4333-9ba8-dcd29b027baa/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/c9ce6cdd55466893068a0f0b4f6b0ea2e96ca3f7d55f818bda2205985037ac0a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/272193/

Comments