MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1a3b9f25708d8add4a5200328941651c2e35c83170c8d51dcbfdfa91aeab4d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1a3b9f25708d8add4a5200328941651c2e35c83170c8d51dcbfdfa91aeab4d6
SHA3-384 hash: 66a1f49ae59293672f4bad108851ec8b43eb25b61e1b2d1d5f4c71062d8996c3103ed8ad4bb90cbfed7e24de26c33e3f
SHA1 hash: 3bc04518b9671b7ed4e068e9ae7dd14c78746ccb
MD5 hash: 62bb7dadf1d8487d2bd745633136cf4b
humanhash: diet-oven-echo-may
File name:62bb7dadf1d8487d2bd745633136cf4b.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:195'033 bytes
First seen:2021-07-16 08:26:52 UTC
Last seen:2021-07-16 08:41:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 3072:iBkfJpRXATwMdFCcGb96DrxpCRv49ruwhcvSc1z77k8j0Vou+/xygxvMfK4aeGqA:iqjIK96pDowkJ37goumxXELavaHqp
Threatray 6'615 similar samples on MalwareBazaar
TLSH T17D14126E7250C8D7E7A6007A1D37A917DFFA5A2231B5A74BBB940B7DF914BD0030A243
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
62bb7dadf1d8487d2bd745633136cf4b.exe
Verdict:
Malicious activity
Analysis date:
2021-07-16 08:29:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/310e6d43-9588-440f-ac8f-db257c9945d5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172140/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.39016.28224.13424.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eadc661c-d67a-4960-9005-2c806e630e15
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817366
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 449778 Sample: fb6YVPzIC1.exe Startdate: 16/07/2021 Architecture: WINDOWS Score: 100 29 www.minx.wine 2->29 31 minx.wine 2->31 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 5 other signatures 2->53 10 fb6YVPzIC1.exe 17 2->10         started        signatures3 process4 file5 27 C:\Users\user\AppData\Local\Temp\ulxak.dll, PE32 10->27 dropped 55 Detected unpacking (changes PE section rights) 10->55 57 Maps a DLL or memory area into another process 10->57 59 Tries to detect virtualization through RDTSC time measurements 10->59 14 fb6YVPzIC1.exe 10->14         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 14->61 63 Maps a DLL or memory area into another process 14->63 65 Sample uses process hollowing technique 14->65 67 Queues an APC in another process (thread injection) 14->67 17 wlanext.exe 14->17         started        20 explorer.exe 14->20 injected process9 dnsIp10 39 Modifies the context of a thread in another process (thread injection) 17->39 41 Maps a DLL or memory area into another process 17->41 43 Tries to detect virtualization through RDTSC time measurements 17->43 23 cmd.exe 1 17->23         started        33 www.jctradingllc.com 74.208.236.154, 49698, 80 ONEANDONE-ASBrauerstrasse48DE United States 20->33 35 www.tjlovers.com 172.67.147.98, 49696, 80 CLOUDFLARENETUS United States 20->35 37 17 other IPs or domains 20->37 45 System process connects to network (likely due to code injection or exploit) 20->45 signatures11 process12 process13 25 conhost.exe 23->25         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f1a3b9f25708d8add4a5200328941651c2e35c83170c8d51dcbfdfa91aeab4d6/
Threat name:
Win32.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2021-07-15 18:44:38 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6gr3t4sxbdmk3vffeabsrfawkhbogxedc4gi2uo4x7p2sgxkwtla._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1a912965cb32d547e15282d11d1251c5fd89a5d2714a198ca26c2ad8597865bb
Formbook
1c2c212dbad3b81d9c6225c3a9f9f6211b10782d228a090f9aa4f038b0270663
Formbook
456614711c0a92e9455fc588f27889ee37c509b2f5e8c901d351346e8cf6140c
Formbook
8d0c96f1776267d62dff665af9687e0a5bb0fa35d9bd151c8871114d797020f1
Formbook
ab6a4abae4d494b05d58dcf9a354231d3c7ae78fec4a62fc1f5559febdc3995c
Formbook
abb1db77386f0eb3cd2c68603ee8817d6d1015287422182845345dad70503564
Formbook
ba02b1ff767d07fbcd13529b70ce92a08238ef31bdfc4058b23023fc8176d26b
Formbook
bc4765682b3b1250e178d1154cfd56fbe1fb4ac0c8e8346d9e6f3ed6c661907d
Formbook
dcea3ce074a9cc06d03641b052fe3a3f81abb72c480de228b8664dade74c4dce
Formbook
f2a1b48f82208d3d1bf4e613fd7c6a16f63c96ebb2c31ed502ec67cb6768b2f6
Formbook
+ 6'605 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210716-xn9k913n26/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.allodrh.com/qmf6/
Unpacked files
SH256 hash:
23ad3cf45bd87442daaa95c76703746ee340ef504b54d9b33850c9aa7e00ba19
MD5 hash:
2531facbdb150cd4885d1b37cc160ce3
SHA1 hash:
dc12d0031c818067c94d88e57d7de39e99dfc040
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/9d6ab7c1-c4cb-4db6-8d26-e7a55c786140/
Parent samples :
f1a3b9f25708d8add4a5200328941651c2e35c83170c8d51dcbfdfa91aeab4d6
27662960c42152868cd03fc425ce95ba5a4ac363aadf4f81bc119bf16ca467dd
ed97e9802edd407c13fe0fa214582d2c4623797bb0c38b0b583a1d919d078284
8e80b677786aa5e787861ea705c89942460ea7d0176df7e64644278e32addffb
SH256 hash:
8a5300097b9690946dff3deca4d93e917c696e8b7eaf08bc4ef85bf43a5aed04
MD5 hash:
797f93a7f09e2d7eb9e616aafea86e77
SHA1 hash:
4699d3b15bd01cd65427b0146eb6933b2ac865bd
Link:
https://www.unpac.me/results/9d6ab7c1-c4cb-4db6-8d26-e7a55c786140/
SH256 hash:
e60acb69dcb844e470fdb3961b7e55bc6f3e1e015fd8fd68785f829a924f6007
MD5 hash:
a12d4ed197b3f52e92286401603a0444
SHA1 hash:
18b526eef09b0e7992f1ace820752d66a87eb69c
Link:
https://www.unpac.me/results/9d6ab7c1-c4cb-4db6-8d26-e7a55c786140/
SH256 hash:
f1a3b9f25708d8add4a5200328941651c2e35c83170c8d51dcbfdfa91aeab4d6
MD5 hash:
62bb7dadf1d8487d2bd745633136cf4b
SHA1 hash:
3bc04518b9671b7ed4e068e9ae7dd14c78746ccb
Link:
https://www.unpac.me/results/9d6ab7c1-c4cb-4db6-8d26-e7a55c786140/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/f1a3b9f25708d8add4a5200328941651c2e35c83170c8d51dcbfdfa91aeab4d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe f1a3b9f25708d8add4a5200328941651c2e35c83170c8d51dcbfdfa91aeab4d6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1335109/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/172140/

Comments