MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccf47d9fd0a0ddce06c265b87f0e2377bb58107c18659ac908b7e3a5731ad081. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccf47d9fd0a0ddce06c265b87f0e2377bb58107c18659ac908b7e3a5731ad081
SHA3-384 hash: 709383f2397caee58c013f1e24d207f2b31e39284d667ad2de4dd0c2be9512ebedc958b8bea1d63923a680c980d20f2b
SHA1 hash: d56c7a44c3026ccb05056234219068264b1704a5
MD5 hash: fb1d1dd02cea10ad0c2dfc967fc233bf
humanhash: river-eighteen-october-september
File name:fb1d1dd02cea10ad0c2dfc967fc233bf
Download: download sample
Signature Formbook
Create hunting rule
File size:799'232 bytes
First seen:2022-02-10 11:35:47 UTC
Last seen:2022-02-10 13:45:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:SUFQkmAOH0hox4+SCwuvZpuKHG1HjKDVFDFQBZUvNTj+N4+O04RVr3:ZJmd6WJrutJeDjY4GCT3
Threatray 13'239 similar samples on MalwareBazaar
TLSH T19F05012427AC83BAD47867F86538423513B53C4A6162EF4E8EE1BCCF39767814452F6B
File icon (PE):PE icon
dhash icon 68686cdcc6a6d2e1 (13 x AgentTesla, 5 x Formbook, 4 x AZORult)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/240620/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.42163.6941.16638.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe update.exe
Link:
https://www.filescan.io/uploads/6204f8aa942573cad44fd062/reports/b098ef5b-4863-40fd-9773-9d5c9a3c054a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9ad7b1df-9348-4b9d-a16c-2bde7db8dac0
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/937622
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Sigma detected: Suspect Svchost Activity
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 570100 Sample: tKms3KO3NP Startdate: 10/02/2022 Architecture: WINDOWS Score: 100 31 www.bhaleraodecoration.com 2->31 33 www.hokashoesingapore.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 9 other signatures 2->47 11 tKms3KO3NP.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\tKms3KO3NP.exe.log, ASCII 11->29 dropped 59 Tries to detect virtualization through RDTSC time measurements 11->59 61 Injects a PE file into a foreign processes 11->61 15 tKms3KO3NP.exe 11->15         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.hantieluliao.com 154.205.233.151, 49824, 80 IKGUL-26484US Seychelles 18->35 37 www.szqhkl.com 172.120.114.173, 49825, 80 EGIHOSTINGUS United States 18->37 39 3 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 svchost.exe 18->22         started        signatures11 process12 signatures13 51 Self deletion via cmd delete 22->51 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ccf47d9fd0a0ddce06c265b87f0e2377bb58107c18659ac908b7e3a5731ad081/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-10 11:36:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
34fc8a270fda2856448cb455e3dca4d8210f5e83f25f1fa8339d8f428a449466
Formbook
3c3ef93ea804d5d80ecbdb244ddf7fe2ab657f54089a397f0c79d89dfef5c95c
Formbook
41d5c1e02c1b4a694660a1c8759ffd46569f5b9574ed99a08d3f00cd2765d2d0
Formbook
6893bbff4695dce3754071670e11d7e7d310ad196b57cdb41cd8c3cd7ea3d8f3
Formbook
79215526b0229696bf3961e09918bca444cb43b079ca70834c54db52c49c51ac
Formbook
a6e23730cd711af23e7900cbabb871b668d37a74dda0c97d63f3303167861cf5
Formbook
b071cb00b3e3d8715ad31c24702fdd284f7cec5ac937b47f7c64f1e630f2c992
Formbook
d2cc3484cdabe8305bf9afd35530ca1118ca2c308408dc7140c3a94b392b60bb
Formbook
+ 13'229 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:c0a7 loader rat
Link:
https://tria.ge/reports/220210-nqk9dahaap/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
754fcac203b05e4b6373de91020ffa72b694d0be6a0aa9e3680ee2443e833d15
MD5 hash:
2e0eba3ae2d6a6c76b648a36b5043ca1
SHA1 hash:
af11e5222e0ab018ffa5db5d2ad65e121271077e
Link:
https://www.unpac.me/results/244c0f68-fbd5-479c-b51e-c06e57c78632/
SH256 hash:
f365b92b11041eed57b6f7534e83e04167fce1cfacc570e79335292f3c0ea8aa
MD5 hash:
9147a2ef317fe384182d1281e5af8110
SHA1 hash:
bbe360e6eca29a32e1f787e1416ddad4d35dcf1a
Link:
https://www.unpac.me/results/244c0f68-fbd5-479c-b51e-c06e57c78632/
SH256 hash:
95dbfa13a08fedd8d2b37038c4149dc7c56cbc006af20b23a7bf1894a6105aeb
MD5 hash:
13f1aceeb374149b125d01e404cc491f
SHA1 hash:
eea7d58182306494db4fef7c578b15067f8300a5
Link:
https://www.unpac.me/results/244c0f68-fbd5-479c-b51e-c06e57c78632/
SH256 hash:
cb1394d16894be7b9488b629afb19674f84d216c1117e68975f94452dbaec74c
MD5 hash:
9e3cfde2483b22fc8fd53bf100daa9b8
SHA1 hash:
5234960821495aec0a74dc440568366b8d9c225e
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/244c0f68-fbd5-479c-b51e-c06e57c78632/
Parent samples :
5750f0a05c92bfe3323fb9e1e3c316a44e01338b9e2f02f4099424c3e37bc8cc
ccf47d9fd0a0ddce06c265b87f0e2377bb58107c18659ac908b7e3a5731ad081
f477ff9ff2a431f168d2defd7c9b62ae9f0648488e9977479e407468d5cdce1e
a73fffb5cb53f03b1a59a712cf34a8b156f1dec4a8c2757a475431edc659e6aa
f84b362a10ce6a355e3d48e602f672416acddab0194b1dc0ffaa01213bf28d2a
SH256 hash:
ccf47d9fd0a0ddce06c265b87f0e2377bb58107c18659ac908b7e3a5731ad081
MD5 hash:
fb1d1dd02cea10ad0c2dfc967fc233bf
SHA1 hash:
d56c7a44c3026ccb05056234219068264b1704a5
Link:
https://www.unpac.me/results/244c0f68-fbd5-479c-b51e-c06e57c78632/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ccf47d9fd0a0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe ccf47d9fd0a0ddce06c265b87f0e2377bb58107c18659ac908b7e3a5731ad081

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2039562/
Cape
Cape
https://www.capesandbox.com/analysis/240620/

Comments


Avatar
zbet commented on 2022-02-10 11:35:49 UTC

url : hxxp://paxz.tk/blessedzx.exe