MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0d703d5576faa3ab83d1a7b6cc08ab55599565c64ec97bb59e05449f3a2efce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0d703d5576faa3ab83d1a7b6cc08ab55599565c64ec97bb59e05449f3a2efce
SHA3-384 hash: 8bf1cf4c1471b4529364c1fbf7ff54cc4533a6fcf8d4597382bd40f34990a780d4be5b42bec5d01d673c37eb0373236d
SHA1 hash: 698a5efcbcafe01ba8214eb6255803f193981716
MD5 hash: 6a4fc759c24fad7472caae24be49eab9
humanhash: happy-lemon-illinois-steak
File name:6a4fc759c24fad7472caae24be49eab9
Download: download sample
Signature Formbook
Create hunting rule
File size:256'763 bytes
First seen:2022-01-26 16:10:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:ow2lQNiSBpkKMHzGlLAJHu/u0+prLIznqmo2I:SlmbPFUum0YGVa
TLSH T1C444121649C0A6FBD94B8FBA0C76C999E7FBAA4F3858014387924FF7153439ED04819B
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6a4fc759c24fad7472caae24be49eab9
Verdict:
Malicious activity
Analysis date:
2022-01-26 23:53:49 UTC
Tags:
installer
Link:
https://app.any.run/tasks/e6b61d57-3f5c-4b21-8dd9-4b31ac5f3e31

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/223490/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61f1729dd73ca9d4648e22ea/reports/5c8d6934-2087-4019-9552-080a870ea402/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bf9e09a9-2d78-4729-bc2a-992d4081138f
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/928085
Behaviour
Behavior Graph:
n/a
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f0d703d5576faa3ab83d1a7b6cc08ab55599565c64ec97bb59e05449f3a2efce/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2022-01-26 16:11:10 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:p2a5 loader rat
Link:
https://tria.ge/reports/220126-tmx2nafabm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Unpacked files
SH256 hash:
0f4a87ceff52441a082768a4809d306f0906d8700e6ef7aab0146ad442d8c2e8
MD5 hash:
403fb1aa3c56887b803180dbebfd7833
SHA1 hash:
3e7e706b0df3fe0953e7671ecb082bc00f7d99ee
Link:
https://www.unpac.me/results/da0c55e1-fe33-47a8-a474-690ceb067a08/
SH256 hash:
7995f55de84308551efa85db5fb6490b6c56de6ef8c5ab3be213f691c66fe061
MD5 hash:
5895ec222ad01e68b76fa0b9c684f52c
SHA1 hash:
f2c321ca1b8e32975ea8f1614113669442c32b9a
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/da0c55e1-fe33-47a8-a474-690ceb067a08/
Parent samples :
5bb063ee2622e4f4e0d61535b8ddc6acd3e5674d4ef098bb4b595f1bb61b847e
502303edd5a9de57b3667146e84f15fc4957242ca2ef8f75f5e503946c452ee2
71bad0685e5b2447a8dcdc960ee2930ad5ec4910d5d449040fb52cb9754df2a2
081be32fe752d7e270c45f1d7a71889aa4452a590963da8dd75e3f26861ddba8
2ef455592017e10cdda6c9a0378a35c232d90ad98d601ca2a1eccb64279fa97e
a0bc464aa74eb9e6e5b10d7d014b21365494bf8610a427f683a7309b78e51d3b
39719289d429bc644b0e8d093e86729d45d4c6449aa615fe142efb5ec86eba69
f0d703d5576faa3ab83d1a7b6cc08ab55599565c64ec97bb59e05449f3a2efce
7cbd8cc35b03d65491ad01b6a44b84dc047e6663189554201c24dbfbeb81473c
b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f
335fa8671bb1ef8659247de4bed05898512fb3a056ef6deb31849eefef8a4743
64ac85dbe848795a0595a96f00817c5616387c26243081cfe33002ce9d89c4a5
7791cb00900b2cedf11970c8f42064656b58c61721b9c230fc0ab15af40479d1
ab928039cd56672d5b9a02322f1d91793cc6fcd3b42217c00cc682a0a42d1620
f1b06407f8fe5e17a2bca06f7c7d54711f41df69163f3e9027c7521c0b17a864
SH256 hash:
f0d703d5576faa3ab83d1a7b6cc08ab55599565c64ec97bb59e05449f3a2efce
MD5 hash:
6a4fc759c24fad7472caae24be49eab9
SHA1 hash:
698a5efcbcafe01ba8214eb6255803f193981716
Link:
https://www.unpac.me/results/da0c55e1-fe33-47a8-a474-690ceb067a08/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f0d703d5576f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0d703d5576faa3ab83d1a7b6cc08ab55599565c64ec97bb59e05449f3a2efce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe f0d703d5576faa3ab83d1a7b6cc08ab55599565c64ec97bb59e05449f3a2efce

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2007495/
Cape
Cape
https://www.capesandbox.com/analysis/223490/

Comments


Avatar
zbet commented on 2022-01-26 16:10:26 UTC

url : hxxp://180.214.236.128/couldA9/vbc.exe