MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d472be00c8fd766636fb12d2acb553ab17876fcf722587c87a8fca98a7d20aee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d472be00c8fd766636fb12d2acb553ab17876fcf722587c87a8fca98a7d20aee
SHA3-384 hash: 69f5f22196e7a190954a7117733d4cceeb336480d2022d48b03f04de5137bc935d66cdcc4a44326af7237fbc9166b0b9
SHA1 hash: 64ac2736eee3d03f655abc1d83a7c2148e82c0d3
MD5 hash: bff071b23ee5f7827bdfd8e7396fb792
humanhash: eleven-vermont-cola-early
File name:bff071b23ee5f7827bdfd8e7396fb792.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:845'824 bytes
First seen:2022-02-17 18:07:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:cdDSXKvrk7nU1tlcNSS6a11T9OkN6fSKGG:uvrSUjcNSSLx7QbGG
Threatray 13'218 similar samples on MalwareBazaar
TLSH T178050204BF63FA06C47A0FBAB8A0D032CBA4E66CB716EA775CD5728C14973E94574670
File icon (PE):PE icon
dhash icon b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/242336/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1197.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/620e8ee8875593a3ccdf6a2c/reports/72d9f365-25b1-43d2-9ea2-d25393745a5c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f5bbf1e7-afe3-4119-b9d2-96c1045c6be3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/941845
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 574326 Sample: wPkX8UVArn.exe Startdate: 17/02/2022 Architecture: WINDOWS Score: 100 32 www.sublike21.xyz 2->32 42 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->42 44 Multi AV Scanner detection for domain / URL 2->44 46 Found malware configuration 2->46 48 10 other signatures 2->48 10 wPkX8UVArn.exe 3 2->10         started        signatures3 process4 file5 30 C:\Users\user\AppData\...\wPkX8UVArn.exe.log, ASCII 10->30 dropped 50 Tries to detect virtualization through RDTSC time measurements 10->50 52 Injects a PE file into a foreign processes 10->52 14 wPkX8UVArn.exe 10->14         started        signatures6 process7 signatures8 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 Queues an APC in another process (thread injection) 14->60 17 chkdsk.exe 14->17         started        20 explorer.exe 14->20 injected process9 signatures10 34 Self deletion via cmd delete 17->34 36 Modifies the context of a thread in another process (thread injection) 17->36 38 Maps a DLL or memory area into another process 17->38 40 Tries to detect virtualization through RDTSC time measurements 17->40 22 cmd.exe 1 17->22         started        24 explorer.exe 146 17->24         started        26 autochk.exe 20->26         started        process11 process12 28 conhost.exe 22->28         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d472be00c8fd766636fb12d2acb553ab17876fcf722587c87a8fca98a7d20aee/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-17 02:15:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2rzl4agi7v3gmnx3cljkznktvmlyo36poisypsd2r7fjrj6sblxa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1088b355d40f002d623e85b8bfe0964599a45abb9fe6c8a4afc8289a85012595
Formbook
197f9af8a87a5870a0b950d3123cfa4c648f941b97cb7c16f392d26b61385d70
Formbook
2084194e47482bf35f4b7c5724d6cf0db56cf4f10811f727a3517579c3985b2c
Formbook
44ec04e0e019c71ef2da463be580df904e323388f5250787c3e186c5e954bbd0
Formbook
54cfa1f93d985c0bf952e00247f781f36988dffec0cb8d83f79fa3e41d98b335
Formbook
921628eeb649a7c9f45ccb4b95ccecba8a76e273a88bdf8478c7e63cef2fb10a
Formbook
9a0379b9363f704c49db190841ceb559ebed609d90f795df77ccf3b23765fa5d
Formbook
a94cf69dea9775df9f51f32d9591f7208ac9c712289a1b851c30de3938b5a976
Formbook
bb7206c1e7aa981a59c0adfea068fc8819665495c4023ce9cb06f86456b37eec
Formbook
+ 13'208 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:cw22 rat spyware stealer trojan
Link:
https://tria.ge/reports/220217-wqbnyachb9/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Unpacked files
SH256 hash:
3923e27b99f5261231ba3f47241c7930ab9b42cc4736ca5d6f60a6ad09540b97
MD5 hash:
a6f7e7288bbf6a0f1abe3d115f79da03
SHA1 hash:
4f7141b3221407d7b4b00d60682a933d868674fb
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/3e549c83-e69f-4e52-b930-87f670b9d663/
Parent samples :
459238db7010365ad248cd0c1afa4947a39bf34b47927dd9ea6e77056979842a
d0eabfe28f6b77c25d883ad3e380620f1367082cc58f309e4d24dd1d2c3548c8
da00ad76bb648365108fb03a95cf69a56608e4605cfe02fcaf933af239ce7ac2
83a185ff11eeb89503c854f293b38c238e02022a357446017524bde45f085570
1088b355d40f002d623e85b8bfe0964599a45abb9fe6c8a4afc8289a85012595
d472be00c8fd766636fb12d2acb553ab17876fcf722587c87a8fca98a7d20aee
SH256 hash:
63b6403c6ea1378c0ff49f069597b45496dba6c0161d240e64885ab6f0806d04
MD5 hash:
72b143fd989c37772556bf302ac33be1
SHA1 hash:
ee377db4778e70261d34f8210208069df41a12ef
Link:
https://www.unpac.me/results/3e549c83-e69f-4e52-b930-87f670b9d663/
SH256 hash:
51d1000e7eb00ceaee467bee5cc9d099ee2e426cb1e7bcd3be42fef52f1f6771
MD5 hash:
3a286ba93cd5cd51ea3f7b1f1ea2cd6e
SHA1 hash:
c6a6d639eee9fc31cf129a8338334a039ec22047
Link:
https://www.unpac.me/results/3e549c83-e69f-4e52-b930-87f670b9d663/
SH256 hash:
9e9db97970f3711980d789bac0fa17e53d58209064310fe0ceb8cbe8b359c911
MD5 hash:
8240f9ed9494afa3a6de93ae714175f3
SHA1 hash:
9090315006b4b5fb6a24cdbf7af4fc0fde74388a
Link:
https://www.unpac.me/results/3e549c83-e69f-4e52-b930-87f670b9d663/
SH256 hash:
d472be00c8fd766636fb12d2acb553ab17876fcf722587c87a8fca98a7d20aee
MD5 hash:
bff071b23ee5f7827bdfd8e7396fb792
SHA1 hash:
64ac2736eee3d03f655abc1d83a7c2148e82c0d3
Link:
https://www.unpac.me/results/3e549c83-e69f-4e52-b930-87f670b9d663/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d472be00c8fd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/d472be00c8fd766636fb12d2acb553ab17876fcf722587c87a8fca98a7d20aee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe d472be00c8fd766636fb12d2acb553ab17876fcf722587c87a8fca98a7d20aee

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2009379/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/242336/

Comments