MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed072604ebceced91d3493f0805453f7e75f2ddbc22158ac6d3c2081a4a6c922. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed072604ebceced91d3493f0805453f7e75f2ddbc22158ac6d3c2081a4a6c922
SHA3-384 hash: b6d3e5dcec2d5f4923f41cf73b6defd0969efa37390afd8ca5f650f42e4725d49b71b1d6fa47c018bdb9bb6d3d1d82c8
SHA1 hash: cc14745b7ac3ff0aa66a47b268adffe66731dc4b
MD5 hash: 01adbbfab7c9df5c6877abe3108eb314
humanhash: wyoming-edward-happy-bluebird
File name:triage_dropped_file
Download: download sample
Signature Formbook
Create hunting rule
File size:647'680 bytes
First seen:2022-06-03 11:33:14 UTC
Last seen:2022-06-03 12:45:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:qhvBDljfBkD+z1bsXKqHCQ703URRDlLkmSfyEDT0uuagDNIOY/dm9do:kJjfidXKqH903ulLkmS6a0uH+IO+6do
TLSH T153D40128FAB3AE27D6BA17B286E1545503F06407B1A2D3CB0EC961D52B02BD5CDC8F57
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter malwarelabnet
Tags:exe FormBook xloader formbook

Intelligence

File Origin
# of uploads :
2
# of downloads :
340
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
triage_dropped_file
Verdict:
Malicious activity
Analysis date:
2022-06-03 11:47:54 UTC
Tags:
formbook trojan stealer
Link:
https://app.any.run/tasks/aa949081-4c86-4b17-ac85-f6b2b4d17aa1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/276524/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1365.6981.5259.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/6299f1888787703a222f9a3a/reports/d0f816d9-8f12-4a16-b507-f6cedaa80476/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/07fbd2cf-cfe9-405b-8b15-27689dc87d3d
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1006287
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd or bat file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 638780 Sample: triage_dropped_file Startdate: 03/06/2022 Architecture: WINDOWS Score: 100 29 www.heycitadel.xyz 2->29 31 www.greenoliv.com 2->31 33 parkingpage.namecheap.com 2->33 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus detection for URL or domain 2->55 57 9 other signatures 2->57 10 triage_dropped_file.exe 3 2->10         started        signatures3 process4 file5 27 C:\Users\user\...\triage_dropped_file.exe.log, ASCII 10->27 dropped 59 Tries to detect virtualization through RDTSC time measurements 10->59 14 triage_dropped_file.exe 10->14         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 14->61 63 Maps a DLL or memory area into another process 14->63 65 Sample uses process hollowing technique 14->65 67 Queues an APC in another process (thread injection) 14->67 17 svchost.exe 14->17         started        20 explorer.exe 14->20 injected process9 dnsIp10 41 Self deletion via cmd or bat file 17->41 43 Modifies the context of a thread in another process (thread injection) 17->43 45 Maps a DLL or memory area into another process 17->45 47 Tries to detect virtualization through RDTSC time measurements 17->47 23 cmd.exe 1 17->23         started        35 myglowups.com 15.197.142.173, 49781, 80 TANDEMUS United States 20->35 37 www.chituer.com 154.23.234.101, 49785, 80 COGENT-174US United States 20->37 39 www.myglowups.com 20->39 49 System process connects to network (likely due to code injection or exploit) 20->49 signatures11 process12 process13 25 conhost.exe 23->25         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ed072604ebceced91d3493f0805453f7e75f2ddbc22158ac6d3c2081a4a6c922/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-06-03 07:35:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5udsmbhlz3hnshjuspyiavct67tv6lo3yiqvrldnhqqidjfgzera._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader campaign:dahn loader persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220603-npe1zaaegn/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Deletes itself
Reads user/profile data of web browsers
Adds policy Run key to start application
Xloader Payload
Formbook
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Unpacked files
SH256 hash:
b8a64a2274939bbde60a0a5f0113677de915972dfff262e8825f03df0b1a1274
MD5 hash:
a88b103f6485b2343118642da019c7be
SHA1 hash:
b66686dbb46215583daa65dfe5c0875212e6112c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/d11ba5e2-ebf3-4e9d-8caa-48d43179e51f/
Parent samples :
2de49b3102da5350531a70b7d670ce8c1a9da5d664d7530325780b9d19aed395
bbf76a25feb60b000b42552adce5f72d871a82d6c6ed3bb72a7f8d94c8886f4d
ed072604ebceced91d3493f0805453f7e75f2ddbc22158ac6d3c2081a4a6c922
f274c2da05a52d01da16c287803a7ea79306fe51c4220f55c19f2bfbe34288b7
SH256 hash:
41c0fb995a393aa3b7937ebfb71a3b2b7dcc834eaa3bfb05406ef02a0d235c8c
MD5 hash:
76bffedfbd850f73cbe39bc65998c9a4
SHA1 hash:
908ad154d4dedc740514915328594e145e24a242
Link:
https://www.unpac.me/results/d11ba5e2-ebf3-4e9d-8caa-48d43179e51f/
SH256 hash:
10782575a7c65584b9390fec65e653715cbe83e64d53ab0237b35c870fc7ef50
MD5 hash:
96a98bbab2e985027c4974edbee3befd
SHA1 hash:
2bc2c5ddf2b9169fe203570fb8246e5a68411e16
Link:
https://www.unpac.me/results/d11ba5e2-ebf3-4e9d-8caa-48d43179e51f/
SH256 hash:
57b590d690282926a8785d05621004e4714ff9f17c51cf305b47e8d4f87f64cf
MD5 hash:
ec2c8dc50a038ffc1eaa789388f53f42
SHA1 hash:
20b131cf5bb9343d5bc7d1c1397f89da76a57a06
Link:
https://www.unpac.me/results/d11ba5e2-ebf3-4e9d-8caa-48d43179e51f/
SH256 hash:
879c29560b21be7d9b69ca27ca4756df86e080fa3e34cb191aad5cb1e5f05504
MD5 hash:
30b6a54a992eae921a2eb8c5ea130911
SHA1 hash:
1c83f0319bffe007077c6656418c9b7344d5affe
Link:
https://www.unpac.me/results/d11ba5e2-ebf3-4e9d-8caa-48d43179e51f/
SH256 hash:
ed072604ebceced91d3493f0805453f7e75f2ddbc22158ac6d3c2081a4a6c922
MD5 hash:
01adbbfab7c9df5c6877abe3108eb314
SHA1 hash:
cc14745b7ac3ff0aa66a47b268adffe66731dc4b
Link:
https://www.unpac.me/results/d11ba5e2-ebf3-4e9d-8caa-48d43179e51f/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ed072604ebce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/ed072604ebceced91d3493f0805453f7e75f2ddbc22158ac6d3c2081a4a6c922

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe ed072604ebceced91d3493f0805453f7e75f2ddbc22158ac6d3c2081a4a6c922

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/276524/
  
URLhaus
https://urlhaus.abuse.ch/url/2223804/
  
Delivery method
Distributed via web download

Comments