MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fad622467720aeeec46ca24a2230629a423c8c4b515d057e9ceb2365ac51a932. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 13 File information Comments 1

SHA256 hash:	fad622467720aeeec46ca24a2230629a423c8c4b515d057e9ceb2365ac51a932
SHA3-384 hash:	a9dfa1fc826d3c03aa26d5efe0cf7318d7d331a92fea5c9ad398a8b6dcdd03f3c897622a5653064ec23d6507367fb8df
SHA1 hash:	0e55b0fbdc8527eafc2725499cb229510635ab4e
MD5 hash:	b8a57bcc581dac289396b20b4a5c2763
humanhash:	hotel-oxygen-solar-grey
File name:	b8a57bcc581dac289396b20b4a5c2763
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'135'160 bytes
First seen:	2024-03-02 15:29:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'611 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:aDQRhAVcU7zlnFUeWRTdNnW9u//D9OZOvYvqfsllE/v9ngvKFa9ukFFoGFXxnq9:asDgdFUtRTdJ4AOZOvYyEragvbIK49
TLSH	T12A358D0776169EA2E2AE173AC1E7450517F1CA9253DBDB0B66C923E65443BBBCEC1303
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

488

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

4363463463464363463463463.bin (1).zip

Verdict:

Malicious activity

Analysis date:

2024-03-03 10:02:06 UTC

Tags:

opendir loader stealer stealc hausbomber redline risepro evasion phorpiex trojan xworm remote socks5systemz proxy raccoonclipper darkcomet

Link:

https://app.any.run/tasks/4c57ca4c-db7a-444c-822d-35bafda21a49

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.EmbeddedDotNetBinary-9940868-0

Win.Trojan.EmbeddedReversedDLL-9940922-0

Win.Trojan.Generic-10014419-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

net_reactor overlay packed packed

Link:

https://www.filescan.io/uploads/65e345fcc51a2f3b9bbf6a32/reports/e180ef2f-d21b-43aa-b819-11634b4f18a4/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/fad622467720aeeec46ca24a2230629a423c8c4b515d057e9ceb2365ac51a932

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

XWorm

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/eed22473-67cc-4645-87b9-d67bbb4c227b

Result

Threat name:

PureLog Stealer, XWorm

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1401898

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Yara detected PureLog Stealer

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/fad622467720aeeec46ca24a2230629a423c8c4b515d057e9ceb2365ac51a932

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fad622467720aeeec46ca24a2230629a423c8c4b515d057e9ceb2365ac51a932/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2024-03-02 15:30:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7llcertxecxo5rdmujfcemdctjbdzdclkfoqk7u45mrwllcrveza._file

Verdict:

malicious

Result

Malware family:

zgrat

Score:

10/10

Tags:

family:xworm family:zgrat rat trojan

Link:

https://tria.ge/reports/240302-sxga8aee81/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Detect Xworm Payload

Detect ZGRat V1

Xworm

ZGRat

Malware Config

C2 Extraction:

gamemodz.duckdns.org:7000

Unpacked files

SH256 hash:

6212eb17aad4e995114d39d4c37d770336a9224e6f2a3b78d36493a30ab72659

MD5 hash:

127ee66640418a45e4c06652c5ba0180

SHA1 hash:

ec1fdbe2389e429662f320e185e12aeaf9d6dd45

Link:

https://www.unpac.me/results/3af49102-8cb8-4b04-94d0-aae9472b756c/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/3af49102-8cb8-4b04-94d0-aae9472b756c/

SH256 hash:

70bb798177d2a4c00bf59193e0b52034f1130e04a667065239b32b1537d3f6e9

MD5 hash:

0cc3cdbbc2620f12303f0fe59f396209

SHA1 hash:

0d2b35fdfd8d68885f8297d7e64121ba74d36251

Link:

https://www.unpac.me/results/3af49102-8cb8-4b04-94d0-aae9472b756c/

SH256 hash:

b0f7388c5c5f365f50f472768fc4fc6cbfe5c322f2e4b64f758e6b5e798a23ea

MD5 hash:

95f94538b947e3eb8c2c882426fc934f

SHA1 hash:

04a9bd1dac8501ce35d9df47636ba8311cefd656

Detections:

XWorm

MALWARE_Win_XWorm

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

MALWARE_Win_AsyncRAT

Link:

https://www.unpac.me/results/3af49102-8cb8-4b04-94d0-aae9472b756c/

SH256 hash:

fad622467720aeeec46ca24a2230629a423c8c4b515d057e9ceb2365ac51a932

MD5 hash:

b8a57bcc581dac289396b20b4a5c2763

SHA1 hash:

0e55b0fbdc8527eafc2725499cb229510635ab4e

Detections:

Typical_Malware_String_Transforms

Link:

https://www.unpac.me/results/3af49102-8cb8-4b04-94d0-aae9472b756c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fad622467720aeeec46ca24a2230629a423c8c4b515d057e9ceb2365ac51a932

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	MALWARE_Win_AsyncRAT Create hunting rule
Author:	ditekSHen
Description:	Detects AsyncRAT

Rule name:	MALWARE_Win_XWorm Create hunting rule
Author:	ditekSHen
Description:	Detects XWorm

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_DOTNET_PE_List_AV Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detecs .NET Binary that lists installed AVs

Rule name:	Typical_Malware_String_Transforms Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Typical_Malware_String_Transforms_RID3473 Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

exe fad622467720aeeec46ca24a2230629a423c8c4b515d057e9ceb2365ac51a932

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2774288/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-03-02 15:29:47 UTC

url : hxxp://218.38.52.227:8000/EjtczQ/RuntimeBroker.exe