MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9f577793aa65b5e41af83ce7a258fd4dee58fc974f5af5952efc137cabbd5a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9f577793aa65b5e41af83ce7a258fd4dee58fc974f5af5952efc137cabbd5a2
SHA3-384 hash: d1eff5e8edfea064ebcc1950059fbfe10bce8bc4a548c781d3345b1ae4a764701bc98c383363931ea9ab51cd549a15de
SHA1 hash: 5115bba3cc3fd65e32b0da2a9787d14290427ad1
MD5 hash: 17ee9ba47769354603ed51cbef1c7039
humanhash: robin-oregon-artist-fourteen
File name:17ee9ba47769354603ed51cbef1c7039.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'169'920 bytes
First seen:2021-04-26 06:25:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:242qo2AaytlDalXl46yoQBKQYRI3t62Q3ovAuVStm/9wh:xo2/8lDUXJyVD/d62Q3L4Ym1wh
Threatray 4'960 similar samples on MalwareBazaar
TLSH F245012165A14F54F9BCA3BC8470407587FAFD23A336EBCE3ED57C883532B805646A66
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
17ee9ba47769354603ed51cbef1c7039.exe
Verdict:
Suspicious activity
Analysis date:
2021-04-26 06:26:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/66445838-92b9-493b-8791-c08bb20bae11

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/144217/
Detection(s):
SecuriteInfo.com.Artemis17EE9BA47769.25419.1128.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/697390
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 397618 Sample: 4x1cYP0PFs.exe Startdate: 26/04/2021 Architecture: WINDOWS Score: 100 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 7 other signatures 2->46 10 4x1cYP0PFs.exe 3 2->10         started        process3 file4 32 C:\Users\user\AppData\...\4x1cYP0PFs.exe.log, ASCII 10->32 dropped 56 Tries to detect virtualization through RDTSC time measurements 10->56 58 Injects a PE file into a foreign processes 10->58 14 4x1cYP0PFs.exe 10->14         started        17 4x1cYP0PFs.exe 10->17         started        signatures5 process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 14->60 62 Maps a DLL or memory area into another process 14->62 64 Sample uses process hollowing technique 14->64 66 Queues an APC in another process (thread injection) 14->66 19 explorer.exe 14->19 injected process8 dnsIp9 34 www.tezhonda.com 103.39.241.110, 49731, 80 WEFE-ASWefeTechnologyPvtLtdIN India 19->34 36 www.theccmsacademy.com 74.220.199.6, 49720, 80 UNIFIEDLAYER-AS-1US United States 19->36 38 14 other IPs or domains 19->38 48 System process connects to network (likely due to code injection or exploit) 19->48 23 wscript.exe 19->23         started        26 autoconv.exe 19->26         started        signatures10 process11 signatures12 50 Modifies the context of a thread in another process (thread injection) 23->50 52 Maps a DLL or memory area into another process 23->52 54 Tries to detect virtualization through RDTSC time measurements 23->54 28 cmd.exe 1 23->28         started        process13 process14 30 conhost.exe 28->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9f577793aa65b5e41af83ce7a258fd4dee58fc974f5af5952efc137cabbd5a2/
Threat name:
Win32.Infostealer.Coins
Create hunting rule
Status:
Malicious
First seen:
2021-04-26 06:25:17 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3h2xo6j2uznv4qnpqphhujmp2tpold6jot226wks57atpsv32wra._file
Verdict:
malicious
Similar samples:
298b7204317915aa463fecd43ee99abbb9020e993dc0ffdcc5e382d0f590a7b8
Formbook
3488d309b21afbc3b481320bcf1209908813e2eb8a63df772f740426034b9958
Formbook
4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006
Formbook
5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489
Formbook
5b7770f02c562dffdbe0cd638e288adba8f340c7231ef30fa2860b7f4b9dfa80
Formbook
64c5f02d627f750a5b60a196ddd53fc03f6bf632e7643cf996effaed8981e05d
Formbook
84e98f3890f5726bce09f463487b93b93de8edff0ba96fb07e06631422ab71d0
Formbook
c9afe6904407e9b60e73edf93efbd932b6725f0f4f33306117ffc9854c21cae2
Formbook
e4938a8244543631ae11deb46e8b4cc3f0a8b8b7c2d4a1246f5bfadb29e0094c
Formbook
f2a1b48f82208d3d1bf4e613fd7c6a16f63c96ebb2c31ed502ec67cb6768b2f6
Formbook
+ 4'950 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210426-j4bgtb48fx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.zlzntiayc.icu/a6ru/
Unpacked files
SH256 hash:
e90a19eba5f2de3ba82f652221105bb0682b07c20abddec487c6f4354ea79c39
MD5 hash:
efb0de4397ea61e17d262e278b53ff86
SHA1 hash:
727fdf2ceb13262d56bdda24a02564fb3e80c8b0
Link:
https://www.unpac.me/results/a2f0db09-378c-46ff-8482-64aef468a7fd/
SH256 hash:
d9f577793aa65b5e41af83ce7a258fd4dee58fc974f5af5952efc137cabbd5a2
MD5 hash:
17ee9ba47769354603ed51cbef1c7039
SHA1 hash:
5115bba3cc3fd65e32b0da2a9787d14290427ad1
Link:
https://www.unpac.me/results/a2f0db09-378c-46ff-8482-64aef468a7fd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9f577793aa65b5e41af83ce7a258fd4dee58fc974f5af5952efc137cabbd5a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe d9f577793aa65b5e41af83ce7a258fd4dee58fc974f5af5952efc137cabbd5a2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1169075/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/144217/

Comments