MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 19


Intelligence 19 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095
SHA3-384 hash: 0c0ca3d40271da6ab0f6013baba155f30f979ef7d208742102777fa1d4fa3dfe97f4130c3e509d2ad02caa88d6ad3d50
SHA1 hash: 9b7f8149232cd2fa537b2507e98cb0bae8e1160f
MD5 hash: 8630a6a245f55a441c08ca6f69cf540e
humanhash: delaware-yellow-november-thirteen
File name:CURRENT#SOA.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:354'996 bytes
First seen:2023-07-06 09:28:05 UTC
Last seen:2023-07-07 07:18:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 429 x GuLoader)
ssdeep 6144:/Ya6+LtBBdMWtx/ZqwJLh7/lykxemZDariZiDmVmDWSpNCYd:/YoLtRMOxRqcFswe62WZMWSXCc
Threatray 3'458 similar samples on MalwareBazaar
TLSH T1A6741248A6A8C85FE8FB5374193A55F2AEFBE72521F802170740BB6D3B13481DB097D6
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter cocaman
Tags:exe FormBook Shipping

Intelligence

File Origin
# of uploads :
3
# of downloads :
276
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
CURRENT#SOA.exe
Verdict:
Malicious activity
Analysis date:
2023-07-06 09:30:40 UTC
Tags:
formbook xloader trojan stealer
Link:
https://app.any.run/tasks/fc1fa37d-b70a-4a83-b50f-07e37aeef934

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/408952/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.22790.23640.8950.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Restart of the analyzed sample
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
Sending a custom TCP request
Setting browser functions hooks
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/95889/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/64a6895f60057e50068446da/reports/eb3eea8c-42bd-43f7-80e3-27d45cad540b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/53632972-c883-46d7-adf8-a8249f2af3e0
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1267972
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1267972 Sample: CURRENT#SOA.exe Startdate: 06/07/2023 Architecture: WINDOWS Score: 100 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for dropped file 2->58 60 5 other signatures 2->60 10 CURRENT#SOA.exe 1 21 2->10         started        process3 file4 44 C:\Users\user\AppData\...\rbkgpyueajs.exe, PE32 10->44 dropped 46 C:\Users\user\AppData\Local\...\vilbw.dll, PE32 10->46 dropped 78 Detected unpacking (changes PE section rights) 10->78 80 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 10->80 82 Maps a DLL or memory area into another process 10->82 84 Tries to detect virtualization through RDTSC time measurements 10->84 14 CURRENT#SOA.exe 10->14         started        signatures5 process6 signatures7 86 Modifies the context of a thread in another process (thread injection) 14->86 88 Maps a DLL or memory area into another process 14->88 90 Sample uses process hollowing technique 14->90 92 Queues an APC in another process (thread injection) 14->92 17 explorer.exe 9 1 14->17 injected process8 dnsIp9 48 www.comienzadesdecero.com 17->48 50 www.8betkrw.com 17->50 52 3 other IPs or domains 17->52 62 System process connects to network (likely due to code injection or exploit) 17->62 64 Uses ipconfig to lookup or modify the Windows network settings 17->64 21 rbkgpyueajs.exe 19 17->21         started        25 rbkgpyueajs.exe 19 17->25         started        27 wscript.exe 17->27         started        29 3 other processes 17->29 signatures10 process11 file12 40 C:\Users\user\AppData\Local\...\vilbw.dll, PE32 21->40 dropped 66 Multi AV Scanner detection for dropped file 21->66 68 Detected unpacking (changes PE section rights) 21->68 70 Machine Learning detection for dropped file 21->70 31 rbkgpyueajs.exe 21->31         started        42 C:\Users\user\AppData\Local\...\vilbw.dll, PE32 25->42 dropped 72 Maps a DLL or memory area into another process 25->72 34 rbkgpyueajs.exe 25->34         started        74 Modifies the context of a thread in another process (thread injection) 27->74 76 Tries to detect virtualization through RDTSC time measurements 27->76 36 cmd.exe 1 27->36         started        signatures13 process14 signatures15 94 Modifies the context of a thread in another process (thread injection) 34->94 96 Maps a DLL or memory area into another process 34->96 98 Sample uses process hollowing technique 34->98 38 conhost.exe 36->38         started        process16
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-06 01:53:25 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6oqw7p3w3r3w5nq3kw22lkungib6o7x7ylqf3bpzhx4wmersgckq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
Formbook
210d5b19dfc3dff919ba6ed4d76d2aa8becc988dabcca66b247d05c51811434b
Formbook
53bb0f293733cadbf6b5704cd0359b61acaa6367eb49268905714492d35ddf81
Formbook
68ba26474bb29bdbc42cfddd75f212eec1ffa22d5c1affc893addce5330f4e11
Formbook
7be1b5e4e93c8fc4f3ea7598ae04c355bd1b9ed369819a327f4a3ca3c2978c09
Formbook
bb5df98c2c7bc29973d2f2eeb67ce8b7a2f9da4166fabe5dfd70e5117e404991
Formbook
c1e64e86dd89a5820bbb518ead2176741f91d3bf5c579e154533d44e816c1f76
Formbook
cbdd01f3d5cf0da163dffcfeb7ac99de37e94c2b3467630dd4b09ac64bd286ca
Formbook
e54d5060f522ac4aae58c95d299bff21e5e6e014c941cd0a9e88485ea29e4ebc
Formbook
ec9d091c881ad4da6f5e77f947c2723b1aa374fbf373931871c767dfb9cabb0e
Formbook
+ 3'448 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:s28y persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/230706-lfw7sahg48/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Loads dropped DLL
Formbook payload
Formbook
Unpacked files
SH256 hash:
2c92c3a13530fbcd3a2768af8671311c3fcf878626ed24febdc65c76cbeaeaf1
MD5 hash:
57ba313b829018ef160b67e61a5a48ba
SHA1 hash:
91aed3316a773ffb22f738bd3b01e10d3803a1f3
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/e0f5839f-29d8-4447-bad4-dee5c0f20684/
Parent samples :
215bf08032eb73c5e0b50bcce07def909e22f769315b0f90ed6cec87b28d44f6
221f3d1fe2ec39b9854c584a51fa3cd49f23995f8ae99c8c7d8e2efa85bb38b0
fa3a477577604a91938f7650b04d3dfaa1d8ec12578d3bb2618817529c8b5797
ec9d091c881ad4da6f5e77f947c2723b1aa374fbf373931871c767dfb9cabb0e
37ae91a0976d913bc1a194207829dc5460afd7b12d4ee22a69129772d151f156
f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095
80c223f70302436ab080c4c7e8d75f3b3d60c4266a41d0afc56fc6c52cb04352
dce92db361fb0e2b6cc00cb1b205288120af9c48b7ffdfc71b5735ad81c72b16
f792e08bbda113fc78f608ed6aea5424257a5fefe071dfa13dd8e88715d36b87
b0d24f4ca574f8e54fc1e23097d9f6b45ec8c37e7732e43a96daea3179b44aa8
SH256 hash:
f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095
MD5 hash:
8630a6a245f55a441c08ca6f69cf540e
SHA1 hash:
9b7f8149232cd2fa537b2507e98cb0bae8e1160f
Link:
https://www.unpac.me/results/e0f5839f-29d8-4447-bad4-dee5c0f20684/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f3a16fbf76dc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip b482a1a6f6a6da0c077a2b67ec5d09db2e74008e36727236e5abe1540f3a9dac

Formbook

Executable exe f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 b482a1a6f6a6da0c077a2b67ec5d09db2e74008e36727236e5abe1540f3a9dac
Cape
Cape
https://www.capesandbox.com/analysis/408952/
  
Dropped by
SHA256 41cc50e5a5a905388164af38c9a7767211a0d2fe3f1a520cc3e6e2af51527558
  
Dropped by
MD5 011515ef4a2427c1d358800b71000618
  
Dropped by
MD5 4fd838ec9f2b71705db1a1d2c4da5c47

Comments