MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb53d9d52d8bb79d32983a428e7b7067952818cee896209c8c08c8de93de7680. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb53d9d52d8bb79d32983a428e7b7067952818cee896209c8c08c8de93de7680
SHA3-384 hash: 35a2b2110b145c81ea0a23208f4ff5c5d8a8aad0ac681af79ab4ddadc4feb467ca359d88215ce9b65e4bbe52170c0d57
SHA1 hash: 01e2477f49e9916866469e2117e77d55aa613b89
MD5 hash: a9c03263c6dd4a1b672955a5ecadc1ff
humanhash: cola-december-oven-cold
File name:file
Download: download sample
Signature Formbook
Create hunting rule
File size:619'008 bytes
First seen:2023-01-30 13:17:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:Fq9i2SvYr3DzQpRqubbdC5QIF/QydtyvscBJeEZLI1kdKKbF7u3fkhJYAP:A9HzHE+mCzQydV6EF4aU
TLSH T1BAD412953BCE0B10E95D307181DF167417E227DE12B3D2EF7E8C328A09163A1EE5AB59
TrID 66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.5% (.EXE) Win64 Executable (generic) (10523/12/4)
5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d2e8ecb2b2a2b282 (106 x AgentTesla, 106 x Formbook, 24 x RedLineStealer)
Reporter jstrosch
Tags:.NET exe FormBook MSIL

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
0900664 MOHS Tender..js
Verdict:
Malicious activity
Analysis date:
2023-01-30 12:35:20 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/f8c69827-8630-48ac-a376-4bde38bb2abc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/358337/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.65246955.20637.21945.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Creating a file in the %temp% directory
Searching for synchronization primitives
Unauthorized injection to a recently created process
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  2/10
Confidence:
75%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/63d7c393696b2d972574e7d7/reports/78c94cb0-1e4a-404d-9748-c12335084481/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b5a997b-fadd-4cc9-bae9-e86176bc33d3
Result
Threat name:
AgentTesla, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1161637
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 794390 Sample: file.exe Startdate: 30/01/2023 Architecture: WINDOWS Score: 100 47 Snort IDS alert for network traffic 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus detection for URL or domain 2->51 53 7 other signatures 2->53 9 file.exe 1 2->9         started        process3 file4 31 C:\Users\user\AppData\Local\...\file.exe.log, CSV 9->31 dropped 63 Writes to foreign memory regions 9->63 65 Allocates memory in foreign processes 9->65 67 Injects a PE file into a foreign processes 9->67 13 CasPol.exe 9->13         started        signatures5 process6 signatures7 77 Modifies the context of a thread in another process (thread injection) 13->77 79 Maps a DLL or memory area into another process 13->79 81 Sample uses process hollowing technique 13->81 83 Queues an APC in another process (thread injection) 13->83 16 explorer.exe 5 6 13->16 injected process8 dnsIp9 33 frogair.online 81.169.145.72, 49714, 49715, 49716 STRATOSTRATOAGDE Germany 16->33 35 44yyds.com 137.59.148.248, 49708, 49709, 49710 PUBLIC-DOMAIN-REGISTRYUS India 16->35 37 21 other IPs or domains 16->37 43 System process connects to network (likely due to code injection or exploit) 16->43 45 Performs DNS queries to domains with low reputation 16->45 20 rundll32.exe 15 16->20         started        signatures10 process11 dnsIp12 39 192.168.2.1 unknown unknown 20->39 29 C:\Users\user\AppData\Local\Temp\sfdh0n.exe, PE32 20->29 dropped 55 Tries to steal Mail credentials (via file / registry access) 20->55 57 Tries to harvest and steal browser information (history, passwords, etc) 20->57 59 Modifies the context of a thread in another process (thread injection) 20->59 61 Maps a DLL or memory area into another process 20->61 25 sfdh0n.exe 2 20->25         started        file13 signatures14 process15 dnsIp16 41 mail.chabiant.az 50.87.253.125, 49723, 587 UNIFIEDLAYER-AS-1US United States 25->41 69 Antivirus detection for dropped file 25->69 71 Multi AV Scanner detection for dropped file 25->71 73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->73 75 7 other signatures 25->75 signatures17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb53d9d52d8bb79d32983a428e7b7067952818cee896209c8c08c8de93de7680/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-01-30 05:30:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7nj5tvjnro3z2muyhjbi463qm6ksqggo5clcbhembden5e66o2aa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230130-qjy8rsae46/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
1428b8c5397a1aec7d7647ae5709a0cb3e95c472b20574b8952ad0b17e8081ec
MD5 hash:
194be633bca4d2d42c9a5f325115e4e0
SHA1 hash:
2ac9d34d453e3a3bcc9c9dc7bba938c122c24dce
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ea59b880-acef-43d0-9148-0e44ce229ad8/
SH256 hash:
e3edb5785e5a80670261a787cdb0eeaa3ebdcf2bcc1d63046065a653b4050f9e
MD5 hash:
061449998a341ef8b1d7e7eb8a445100
SHA1 hash:
264f9f8f50c2574bba2ab77517f07127741bb106
Link:
https://www.unpac.me/results/ea59b880-acef-43d0-9148-0e44ce229ad8/
SH256 hash:
fb53d9d52d8bb79d32983a428e7b7067952818cee896209c8c08c8de93de7680
MD5 hash:
a9c03263c6dd4a1b672955a5ecadc1ff
SHA1 hash:
01e2477f49e9916866469e2117e77d55aa613b89
Link:
https://www.unpac.me/results/ea59b880-acef-43d0-9148-0e44ce229ad8/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fb53d9d52d8b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/fb53d9d52d8bb79d32983a428e7b7067952818cee896209c8c08c8de93de7680

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:NETDIC208_NOCEX_NOREACTOR
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe fb53d9d52d8bb79d32983a428e7b7067952818cee896209c8c08c8de93de7680

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2522632/
Cape
Cape
https://www.capesandbox.com/analysis/358337/

Comments