MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14c6d459ec4d91f072fb28a38c6e11a4f616ef84c3faf4c10feb3aec45529ed7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14c6d459ec4d91f072fb28a38c6e11a4f616ef84c3faf4c10feb3aec45529ed7
SHA3-384 hash: 2d3fb3c9f1f8a545b857a394d7c2aec6e08d293568c15d2d3e4fe22bb93a38dea227b0c73627d8bef5616b4ec45c4cdc
SHA1 hash: 73a18fec7c5276ec75d0984e2faf1b56a9b597cc
MD5 hash: 75f809925550c96307ba1c1c25d0a3d1
humanhash: november-golf-may-juliet
File name:PO1000510.exe
Download: download sample
File size:419'840 bytes
First seen:2020-05-05 06:22:30 UTC
Last seen:2020-05-05 06:48:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:o7r8z0Jt8Dm7+S2AVPQ+94FeSkWmT1wKTf/mmERGiiJ7toYUm7HwRYQTMt:arIDOd2Au1RmTfWGiiUeQTa
Threatray 5'097 similar samples on MalwareBazaar
TLSH 81949E6129D60259E27BAFBCB9DC21E1AF28A173330EF70F854112957DE2F71D94A01B
Reporter jarumlus

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44363.27775.14443.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 08:39:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ctdniwpmjwi7a4x3fcryy3qrut3bn34eyp5pjqip5m5oyrkst3lq._file
Verdict:
malicious
Similar samples:
34e97a0a96c8965670b1cd995a66c69a8ee72e59a76633e3fe8c8e0dc181f29e
5a67dee45b2e60de47e22739c8be8614f31cdb4acbaf554f37d06ea41ddd8762
6692dfd11b39875711297b99f0139009a90c2db02fda83ace3f18c579dd75e48
77d3a28cd34ad07bbae3fe893ee4e92731be71f1fad1b632840c0bf3b5bc594e
79ed25d14bd82eed48aae26c3ea3d4e6a334774296d2189832551ddb57abbafc
7e9657bb8f4920565b2cbdc1add6d78026fc4e8047632ba077463e5991e105ee
a866218f15c4a57d3bd29aa9a3cf71c3c23568647f8f983de57c2e7019bbb728
d606ad2f22a8def869afd7e352766c880404a40948ac435d62d136ea7d61efcc
f88d711b452d2678a61e6963c47457a1604491f2bbe6ed13d4710ce6f07d7b72
fc178548910fecad24f84095745d2ea59340b4c51cfb756f78f1d7811e570662
+ 5'087 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan persistence
Link:
https://tria.ge/reports/201109-v2zejztbma/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of UnmapMainImage
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.porcber.com/b5c/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments