MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8d64de8061469f13cef1bffd0a1f45a5bea64f918acaf76026e04130185764c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8d64de8061469f13cef1bffd0a1f45a5bea64f918acaf76026e04130185764c
SHA3-384 hash: da8e0478a9971ac8b9ed824603d51f8e4f63b5c859a6109de7f39d69f4f2bd83c4fc2b6e8d82a1cc359412f98eb5177b
SHA1 hash: 53e9c1a17f2ab288c1fa02a240874fb7a143b42c
MD5 hash: 926da4414cfbe7f69ceda42ccb0b5f41
humanhash: alabama-uranus-failed-sierra
File name:926da4414cfbe7f69ceda42ccb0b5f41.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:302'579 bytes
First seen:2022-02-16 18:54:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:owNnZCU1FnfvR1LrGa3GDNdZEvNgrUwe80+EMZWM5j:3BFnfjrGa3e/E8Uwe80RqP
Threatray 13'356 similar samples on MalwareBazaar
TLSH T1C354121234D5C8BBDDD7083566B76ABFE07FB172A0E1D50F1BB00F791564AC248AD28A
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/242026/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Searching for synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/620d4894ac8ad0468b480a0b/reports/5685a2f4-2b6d-4344-8486-4272f24ad2c8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4aa64831-21ff-4c9e-9139-f7084b694b45
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/941144
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 573626 Sample: hzJoXG8NY5.exe Startdate: 16/02/2022 Architecture: WINDOWS Score: 100 35 www.ehaszthecarpetbagger.com 2->35 37 www.360e.group 2->37 39 360e.group 2->39 57 Multi AV Scanner detection for domain / URL 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 5 other signatures 2->63 12 hzJoXG8NY5.exe 19 2->12         started        signatures3 process4 file5 33 C:\Users\user\AppData\Local\...\vhtqzjig.exe, PE32 12->33 dropped 15 vhtqzjig.exe 12->15         started        process6 signatures7 73 Multi AV Scanner detection for dropped file 15->73 75 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 15->75 77 Tries to detect virtualization through RDTSC time measurements 15->77 79 Injects a PE file into a foreign processes 15->79 18 vhtqzjig.exe 15->18         started        process8 signatures9 49 Modifies the context of a thread in another process (thread injection) 18->49 51 Maps a DLL or memory area into another process 18->51 53 Sample uses process hollowing technique 18->53 55 Queues an APC in another process (thread injection) 18->55 21 explorer.exe 18->21 injected process10 dnsIp11 41 www.frentags.art 44.227.76.166, 80 AMAZON-02US United States 21->41 43 www.gaboshoes.com 21->43 45 3 other IPs or domains 21->45 65 System process connects to network (likely due to code injection or exploit) 21->65 25 mstsc.exe 12 21->25         started        signatures12 process13 dnsIp14 47 www.frentags.art 25->47 67 Modifies the context of a thread in another process (thread injection) 25->67 69 Maps a DLL or memory area into another process 25->69 71 Tries to detect virtualization through RDTSC time measurements 25->71 29 cmd.exe 1 25->29         started        signatures15 process16 process17 31 conhost.exe 29->31         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f8d64de8061469f13cef1bffd0a1f45a5bea64f918acaf76026e04130185764c/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2022-02-16 13:45:06 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
34fc8a270fda2856448cb455e3dca4d8210f5e83f25f1fa8339d8f428a449466
Formbook
41d5c1e02c1b4a694660a1c8759ffd46569f5b9574ed99a08d3f00cd2765d2d0
Formbook
6e6e18a85c523bfffd1b5293b978832f7387fda9b9eee87d3d8e98666fe020c9
Formbook
8c4f6fdac7ad099e36f33ba17cb2f7439dc95916f4013b652f464c866fe88fdc
Formbook
9c4f8b76224562025127d622105346856558b314a57bf42fac2d7bf61de8b22c
Formbook
a6e23730cd711af23e7900cbabb871b668d37a74dda0c97d63f3303167861cf5
Formbook
f37548aa52109fbdf38ab248aadb6809eb3a677a15f6916883d9612cec4ffa86
Formbook
+ 13'346 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:b80i loader rat suricata
Link:
https://tria.ge/reports/220216-xkswpsdchn/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
0c3a45da7ec9a0c118c42decdf545d44289cb1f362f9de3ac3a775a0f6593ebc
MD5 hash:
aceaee03848ffe132194e3e674d14135
SHA1 hash:
9f16971f647cfea9eaef5a0a1e045a0d8a282db9
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/06a2b647-7800-41da-bf81-dec22a5ca8bc/
Parent samples :
78bb96983441b23a5dc66dbf465887bfd3c26ccf3dda2557f17e291dd11076bd
08d17b9c0d3ab4eb79a38b0a500655f9f47bc3468718ae5b61d59d0b2b687e53
1ec8f5c2a626d9484af9532ed48a5b7482fc0dcdab074d8545ac8e4454c68a89
59b1f5cc85d4edc7bcd38811f27e9991a829e977cbadd58913670d434dfbfeff
02c848711be5356cc435b98837bdf0120cac86fdeaa5238793a3ab6300482147
f8d64de8061469f13cef1bffd0a1f45a5bea64f918acaf76026e04130185764c
SH256 hash:
e5cdb6b1d71b00dbd536297eb42200f482bacbd22620b90e189aa59d3d999ee4
MD5 hash:
86909e605c42bec0c8b01089724ce9cd
SHA1 hash:
1493ad06ff26fcfe626e9cf7c459e5ce16983b9a
Link:
https://www.unpac.me/results/06a2b647-7800-41da-bf81-dec22a5ca8bc/
SH256 hash:
f8d64de8061469f13cef1bffd0a1f45a5bea64f918acaf76026e04130185764c
MD5 hash:
926da4414cfbe7f69ceda42ccb0b5f41
SHA1 hash:
53e9c1a17f2ab288c1fa02a240874fb7a143b42c
Link:
https://www.unpac.me/results/06a2b647-7800-41da-bf81-dec22a5ca8bc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/f8d64de8061469f13cef1bffd0a1f45a5bea64f918acaf76026e04130185764c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe f8d64de8061469f13cef1bffd0a1f45a5bea64f918acaf76026e04130185764c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/242026/
  
URLhaus
https://urlhaus.abuse.ch/url/2028772/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2033765/

Comments