MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec744aeae689c95f44a24eb398e65c3a722595de5504db84b2e41488f30a7510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec744aeae689c95f44a24eb398e65c3a722595de5504db84b2e41488f30a7510
SHA3-384 hash: 931f4e10878043a0d176de914c5576680b106a1e2c200548558c3b680acf40775c1143a2d08d9cfa4f4c87a466e8a756
SHA1 hash: c8ba80eb0907a049f2f4bfb7775266ab83da971e
MD5 hash: 884e8962c1368f3787f7f2ae964e5bf9
humanhash: september-alaska-batman-green
File name:SecuriteInfo.com.Trojan.GenericKD.36466914.11972.20044
Download: download sample
Signature Formbook
Create hunting rule
File size:1'494'016 bytes
First seen:2021-03-09 10:49:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:2+XXZr9kUMi5S/WqeUayGz+ujp8Gqqwq3prTjB:zXZJpMi5SUUzGzjZqqwq3pT
Threatray 861 similar samples on MalwareBazaar
TLSH 9B658C49BBA4AEB6D118CF36851380188FE9C6675336F25B79C1BCE51B373894E1F026
Reporter SecuriteInfoCom
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.GenericKD.36466914.11972.20044
Verdict:
Malicious activity
Analysis date:
2021-03-09 10:53:03 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/3fe2fb49-a38b-449d-ae00-9bb6a68db880

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/123145/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36466914.11972.20044.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Running batch commands
Launching a process
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
DNS request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/632577
Signature
.NET source code contains very large array initializations
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 365252 Sample: SecuriteInfo.com.Trojan.Gen... Startdate: 09/03/2021 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for dropped file 2->45 47 5 other signatures 2->47 9 SecuriteInfo.com.Trojan.GenericKD.36466914.11972.exe 15 7 2->9         started        process3 dnsIp4 39 192.168.2.1 unknown unknown 9->39 31 C:\Users\user\Driver auto update.exe, PE32 9->31 dropped 33 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 9->33 dropped 35 C:\...\Driver auto update.exe:Zone.Identifier, ASCII 9->35 dropped 37 SecuriteInfo.com.T...66914.11972.exe.log, ASCII 9->37 dropped 57 Drops PE files to the user root directory 9->57 59 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->59 14 Driver auto update.exe 14 2 9->14         started        17 cmd.exe 1 9->17         started        file5 signatures6 process7 signatures8 63 Writes to foreign memory regions 14->63 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->65 67 Injects a PE file into a foreign processes 14->67 19 AddInProcess32.exe 14->19         started        22 conhost.exe 17->22         started        24 reg.exe 1 1 17->24         started        process9 signatures10 49 Modifies the context of a thread in another process (thread injection) 19->49 51 Maps a DLL or memory area into another process 19->51 53 Sample uses process hollowing technique 19->53 55 2 other signatures 19->55 26 explorer.exe 19->26 injected process11 process12 28 raserver.exe 26->28         started        signatures13 61 Tries to detect virtualization through RDTSC time measurements 28->61
Gathering data
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-03-08 06:54:31 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5r2ev2xgrhev6rfcj2zzrzs4hjzclfo6kucnxbfs4qkir4ykouia._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0ecfbf08398e1d0470c2f4d40a490808bd1b177cb60d674c5459d85f242952ab
Formbook
1eec60cc3fe95b8f138a1053af0bafb598760075adabd8a99dced1ccf3302df4
Formbook
203ac3379fb9ca3dd9c50d81234c753493ac422538c30d9a9ea07cb5f5042a7b
Formbook
5024f734215b78dad35ba4390d346c029d19eb14d90983cf48c2b16726df14d9
Formbook
8948c6ec9f9e49de7b8546ae27fbaf0d95cb773c27cd10a1d62a45f7608dd651
Formbook
955a5c96b1add7e062fe16492b630073f9aef9b50e10c9928d5510ebbe10f56f
Formbook
a4d205329a6c438c3442880287c5fb05810fb3de3bf82ddcba557176c2a6d7fd
Formbook
bc568f10fe943dccb25ea6cd830cd4d54fbeef748e7da33bfac086f496c71bb2
Formbook
d0a2be2c26efa68a6f69a4173b21c251b3c1e55b4d64cdf67394f923c9c23452
Formbook
d0b4ea79bfa3aad2d6343a52811b837c45229253cda7abb26b4df2107ab52d58
Formbook
+ 851 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader persistence rat
Link:
https://tria.ge/reports/210309-gkanq8mrh6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.dubainights.net/rrrq/
Unpacked files
SH256 hash:
ec744aeae689c95f44a24eb398e65c3a722595de5504db84b2e41488f30a7510
MD5 hash:
884e8962c1368f3787f7f2ae964e5bf9
SHA1 hash:
c8ba80eb0907a049f2f4bfb7775266ab83da971e
Link:
https://www.unpac.me/results/dd89c45f-9a5e-4214-a220-ea77a08e5856/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/ec744aeae689c95f44a24eb398e65c3a722595de5504db84b2e41488f30a7510

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe ec744aeae689c95f44a24eb398e65c3a722595de5504db84b2e41488f30a7510

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/123145/
  
URLhaus
https://urlhaus.abuse.ch/url/1056361/
  
Delivery method
Distributed via web download

Comments