MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb
SHA3-384 hash: 150e1f3d633c851eb90132f0a06fbd79bcf5a0916d32d804e58e4ccff2e974c1af03e603527664b87618b3280ad607c1
SHA1 hash: 92a54138d81c76fd057919b4e932374c90a337b6
MD5 hash: 1c53f8f351aa28400483b8791dcddb30
humanhash: potato-failed-arkansas-mike
File name:1c53f8f351aa28400483b8791dcddb30.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:492'032 bytes
First seen:2021-11-05 09:21:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:HoNyXtX5CCQuRtyrQRJly42aKtrGHFT82ul:INmDQFu7/TN
TLSH T1FAA41251B7E47B17E6BC0BF53C7112B81BB6B50D0671E34C0C92B4E769A2B419A10FAB
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1c53f8f351aa28400483b8791dcddb30.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-05 10:28:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b8db2082-2254-412b-bbbf-a865a150f60b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/202629/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware obfuscated packed
Link:
https://www.filescan.io/uploads/6184f7bd8eec3805367f94ec/reports/31ec1874-4907-4c49-ae06-e0481a0fcb6f/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9e4e5be6-d142-49aa-b7e6-a6e1a72d9700
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/883946
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 516380 Sample: AWRbsjUjtS.exe Startdate: 05/11/2021 Architecture: WINDOWS Score: 100 31 www.hartfulcleaning.com 2->31 33 www65.wixdns.net 2->33 35 4 other IPs or domains 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 6 other signatures 2->49 11 AWRbsjUjtS.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\AWRbsjUjtS.exe.log, ASCII 11->29 dropped 59 Tries to detect virtualization through RDTSC time measurements 11->59 15 AWRbsjUjtS.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 37 hillcresthomegroup.com 15.197.142.173, 49801, 80 TANDEMUS United States 18->37 39 floaterslaser.com 81.169.145.161, 49799, 80 STRATOSTRATOAGDE Germany 18->39 41 10 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 msiexec.exe 18->22         started        signatures11 process12 signatures13 53 Self deletion via cmd delete 22->53 55 Modifies the context of a thread in another process (thread injection) 22->55 57 Maps a DLL or memory area into another process 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-11-05 09:22:08 UTC
AV detection:
7 of 44 (15.91%)
Threat level:
  2/5
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:fqiq loader rat
Link:
https://tria.ge/reports/211105-lbxbzsbbd2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.esyscoloradosprings.com/fqiq/
Unpacked files
SH256 hash:
36962a581f91e7f4920e3da5c34a4753efa23e5dd51822b52fa726c44aa3be51
MD5 hash:
0fcc97c13416adb52d58364646db8ef8
SHA1 hash:
8fba0404952912070ee5ae0ac760519f498daf0f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/faffd65f-14b3-4fa5-94ae-880884b7efa5/
Parent samples :
6ffe756ce71f1457d7dd480357f3545f123b750fc4bf30683b59887d491948a7
092be1f456b0c24d932d6c4e4c44cfd0c9abc6c0418bf1567e67826cb51aef14
91a166f9a29ad832c9640078210a47e5afa928ab1a79a7b40d3b358e9c8bc5d5
9136c283e5029c2f073b706014f6f73b67ead84450267cb5ce0dd26cbcecaa25
89b049bc712096512185d1607a9318c074885b2d5b529e0985dc92cdd94d1f51
d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636
ba22bb07f3ef12877682493d25ed29cf6e2ca6c9ce2bc9527396a7bae00ec578
4340e97182604cbe78767ba17c66b1d106d7e28855fc5ef3737142b41656cd9c
6d2abaaa61c35b3bc1cf8ae531dd9505406379b70f414f806974d0202365d14e
1d3c91b0ec0e3b039a78c042eec94a3aebbe5da4d6e61cf7b7e54de22084d4a3
aaf0400f83fd271800e1f4cb50fab438958eb3771a6b6a9401c5fa66c1c5b956
832c65a202ec1c69a8297af3d2fc3d233ac65b7c2c670f30d0694089601c9cfe
58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57
36465b5c8b0baa57cc7d26405d290bff57488f216c72654b2773e506dc6646df
b16670d7ab7fc43029ef6033d5bf6b8a3ad78f09fefed66ec6351c7eac0a53f8
37669e84be570d6748f6bae3adbaf41a969894111073837204f526a1f8c8dad9
c0363e690238ce1be218baa1c66a3fe647df3740da9448788945c6863ac6b07c
a104d6d98afd1eca774c2b8b12aee19bbc52216a358d9bf00ebfb503ef8e553d
0e636b89393a1581a2e3f4b141c9886bed9c77969569605cdb44b78d94127802
060c2f164a53cf74817b9b2f176d770dbde8b1ef71fe5322abf9ae8197232b7d
43d01d2eb5232707d644d1ea624c347b98220adbbdb7a8bd625814a5b971dd2d
37fe8e29a0b03c101b7de698fe335669bd98d2f4afdbe202bca00ceef540bd5d
88162d7f1cc5091fe38963f350017010d2ff7167e4d50c84599ad9f3b29a1a2d
5fa1ff89c81ecaec98e5995fbfe4df5caaa1da2f514d2deefff5ea91938d579f
b2663af445ff18476795d3462841a45488a9f2fd53c92d0c798e2e24892e10ae
cd9c2941f474d97ebaf1b88641fa3153958c8936939b77e0a62fb19fa488b25f
be6f833816e4dd59791654e138d793e1bfb6bfe016f34ae63b9b3e2f6106fc55
1764a3523eb73d0b632820c013bb2a723fbb3779c7eb59c7e0b67cd488deda6d
f0a7f92f4fa639da7f829e82242a21aa8861bc98f1783b51638e04dc148e81b5
92dfbdc903edcc919f426dc689d4461d354d15d77bf7f865db884f5de11d1253
29e85e2310c309eb1fc9939287177b02a8b4b096c2b600b2bd47a8e1acb58f36
28903cad5faee3c56985c052982d83527166253a85a74315ecca8d6dc17e6a59
ff50a282945cb9b5a738f97aa08714f874469eaa4ed79fcd0c5fd0c12d6a4be8
3d50a61d513475fc02d1685b3e4af3d10c2b23136c41703552e0e41b35fbeae9
7e6b468c991367b78ad9d9a9437ab4a4efd789203038a75e687cc3beaa346dd7
ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb
19e393a62338d6cc292c4aadeab10121a453635fdb5fe291d295a3a6fc6ef712
d042461c8232d82419b3c843757d65e0e3ccfcdaf7d12c03c7e027f5b8639854
7a1a96acb6fbf74b821d7cad25b8912cbb97ea2eb4b847289cc0486705984fda
6b9d128b143bc2ec8b72ac36891a5b12887f182de44ae5e367c0a486b774a59f
12c431c9695b91725092b2261e1f4d251d682fdc0784ae3c7df3a7a478f194f6
dab06b4d2862c59c9a454d29852d9bf4a15462d660ff65e0a29d987d6b8f320c
63c0f55aa5ab5b3cd05a335deb13a29dee7f1bc41b860c716239c44a2bef39f4
7538dd54090aa1debe47b52503cf0099fe2b2839f08ff282dacd31734a0bcb9a
55b588d9d763bee7e3a03b6bb027af6ccd779fadd9022696d31e102a97f1b18b
dcd2e00fc2a47d732fd3d0d79fd224caac8bee02053a1b02ba4e51e022a949f9
bd7cddd657e0144076352a60664ca134c2ddee8ffe8da70793d5b97f17cf9318
933a2e4716b395f6fa6aed9ae203901742b7993fdb29d5b2f56a3c82f80fc095
b30e2fa345e02eecf58f3672cab4f07b4c6f84712c7dee9a64ca3005ac7bf255
a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
821d7489d8ef08b8ebdfb08350ac7cf3ae8ac918b4a1aa4bcbbcc0ffbd668059
SH256 hash:
b41e01e77d59c76c904287e72c0318b8f5f8830a5c24aa939912fde9c00690cd
MD5 hash:
c6b4f04356789596430947ee9af3d0f3
SHA1 hash:
d06d32c0983e714d37616bd344ef14fcadd11beb
Link:
https://www.unpac.me/results/faffd65f-14b3-4fa5-94ae-880884b7efa5/
SH256 hash:
6592340f09d4454e7e87721cf771981371b16458a2ea280bf84293634d1b79db
MD5 hash:
90f1ffa368db826eb87e6c228d1cd0bb
SHA1 hash:
6168f389d294486f489f4b711497b184c608646d
Link:
https://www.unpac.me/results/faffd65f-14b3-4fa5-94ae-880884b7efa5/
SH256 hash:
ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb
MD5 hash:
1c53f8f351aa28400483b8791dcddb30
SHA1 hash:
92a54138d81c76fd057919b4e932374c90a337b6
Link:
https://www.unpac.me/results/faffd65f-14b3-4fa5-94ae-880884b7efa5/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ee2706bc2dce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1750399/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/202629/

Comments