MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f
SHA3-384 hash: 0d9d9daa26331528215d717f9ab745adda8bbf8b13c848403615b2c029aba1f0c60697dcf6ab32a050f1b645df1fc24e
SHA1 hash: 74e2706e79d880cd5ba8e5c42368b6fdeee96bec
MD5 hash: f96cf5405f122cc40d943d0399ed7bc7
humanhash: ceiling-speaker-shade-fix
File name:SecuriteInfo.com.Win32.PWSX-gen.29487.15246
Download: download sample
Signature Formbook
Create hunting rule
File size:744'960 bytes
First seen:2023-07-04 11:47:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'604 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:RmbKfEnWZDFWFwqOBvefqrNrzr37/WUsbiV9:qRnp4hVprr/aS9
Threatray 3'314 similar samples on MalwareBazaar
TLSH T117F45C3819BC5E22C075C7F68B95C061B26499EF31A5CF2A5BC296D5061EF0229C7E3F
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0f2c48e8edcb0b2 (2 x Loki, 1 x Formbook)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.29487.15246
Verdict:
No threats detected
Analysis date:
2023-07-04 11:50:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2d2c3a21-6801-46e4-8f65-a0aaf5f053f3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/406425/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.29487.15246.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64a406f4204315fbc16cb2e4/reports/a0c10120-b0a2-4604-959e-bdce39d2ddc6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/58de5031-ee75-44d2-89d6-0c899e848e2a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1266549
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-07-04 11:48:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
75
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=an7gbmheomqd5bo6qm2eyzbweo2rtsfuoj47tzwaw5bad3hhja7q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1b28956f786cc8462290c89bbb169b660d377acd7a1867408bcd9362edb42a5b
Formbook
2fdacdb36dfe8221e189f86b9ec7fbb6673a05b0b3ca396bfcf8240b0212b3b4
Formbook
4baf37305afca03942dfd3f13c173cd45d587cd358adde2b6f1596fc761eaae2
Formbook
59d3d0d82273ee3a78483d3508a8247593a06826f8531de8ca072718e6609598
Formbook
7364133b920b40a6d5583a6ae12d8f510df7f2f65da5c026bd7c9ffbe3e54e57
Formbook
c104d364eec79cad7a9c9040ff30d46e6b2bf694b3c8f80130bb599345fc3d76
Formbook
ca92353954eb428f99d73b11f26650f1ed59df39a99a04d45552c8b9ba4e1459
Formbook
dd7311a0428c78cec1db4fbca409094ab6694db68c03aa878f9f1872ecc6e1db
Formbook
e8f271e2c00c7310ba76f5be24f425df7b4c3fdd84a0b715906a10da4f7e879b
Formbook
f362a8543a40e8bdc5bccda150334bdd2f53f4b169725b3522064aa27992d1c9
Formbook
+ 3'304 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:mf6w rat spyware stealer trojan
Link:
https://tria.ge/reports/230704-nyerkadg8y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook payload
Formbook
Unpacked files
SH256 hash:
93bf910294296262548b8c72f27559f7a53ac661a2408aa027895152ce159246
MD5 hash:
e01ab77d24d1ad06fa9010a4209a204f
SHA1 hash:
e8114cefafa35c6d55fe3d2c6b6046c4b81ca254
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
Parent samples :
cbdd01f3d5cf0da163dffcfeb7ac99de37e94c2b3467630dd4b09ac64bd286ca
037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f
c64ca90a3608e3edaaf04f3289f58d018f2e6301409665820d92c61130784d23
e165bef062d93e5a4fd31d8f369fd8144d2158b5c8dcb85be3e06826cb5f81e6
f5faa1f9d476120a03f1a187f2f9814adf698fa9c0123ed44a2b5ce9ad8055bd
571890d2bedd6cc0cdf6cccc2e6fc4e19c7489adc30328c24d21e3631d24661e
SH256 hash:
1163575e23a6d7ed4eaa8abc2912a0f4e91fbdaedbf12c97412f941e585b5e9e
MD5 hash:
40152ecc5ecfdff3c372998ea1fa24f9
SHA1 hash:
d9054cad70a989b4d81be6fa846dfbc9989c0fef
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
93bf910294296262548b8c72f27559f7a53ac661a2408aa027895152ce159246
MD5 hash:
e01ab77d24d1ad06fa9010a4209a204f
SHA1 hash:
e8114cefafa35c6d55fe3d2c6b6046c4b81ca254
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
Parent samples :
cbdd01f3d5cf0da163dffcfeb7ac99de37e94c2b3467630dd4b09ac64bd286ca
037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f
c64ca90a3608e3edaaf04f3289f58d018f2e6301409665820d92c61130784d23
e165bef062d93e5a4fd31d8f369fd8144d2158b5c8dcb85be3e06826cb5f81e6
f5faa1f9d476120a03f1a187f2f9814adf698fa9c0123ed44a2b5ce9ad8055bd
571890d2bedd6cc0cdf6cccc2e6fc4e19c7489adc30328c24d21e3631d24661e
SH256 hash:
1163575e23a6d7ed4eaa8abc2912a0f4e91fbdaedbf12c97412f941e585b5e9e
MD5 hash:
40152ecc5ecfdff3c372998ea1fa24f9
SHA1 hash:
d9054cad70a989b4d81be6fa846dfbc9989c0fef
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
93bf910294296262548b8c72f27559f7a53ac661a2408aa027895152ce159246
MD5 hash:
e01ab77d24d1ad06fa9010a4209a204f
SHA1 hash:
e8114cefafa35c6d55fe3d2c6b6046c4b81ca254
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
Parent samples :
cbdd01f3d5cf0da163dffcfeb7ac99de37e94c2b3467630dd4b09ac64bd286ca
037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f
c64ca90a3608e3edaaf04f3289f58d018f2e6301409665820d92c61130784d23
e165bef062d93e5a4fd31d8f369fd8144d2158b5c8dcb85be3e06826cb5f81e6
f5faa1f9d476120a03f1a187f2f9814adf698fa9c0123ed44a2b5ce9ad8055bd
571890d2bedd6cc0cdf6cccc2e6fc4e19c7489adc30328c24d21e3631d24661e
SH256 hash:
1163575e23a6d7ed4eaa8abc2912a0f4e91fbdaedbf12c97412f941e585b5e9e
MD5 hash:
40152ecc5ecfdff3c372998ea1fa24f9
SHA1 hash:
d9054cad70a989b4d81be6fa846dfbc9989c0fef
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
93bf910294296262548b8c72f27559f7a53ac661a2408aa027895152ce159246
MD5 hash:
e01ab77d24d1ad06fa9010a4209a204f
SHA1 hash:
e8114cefafa35c6d55fe3d2c6b6046c4b81ca254
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
Parent samples :
cbdd01f3d5cf0da163dffcfeb7ac99de37e94c2b3467630dd4b09ac64bd286ca
037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f
c64ca90a3608e3edaaf04f3289f58d018f2e6301409665820d92c61130784d23
e165bef062d93e5a4fd31d8f369fd8144d2158b5c8dcb85be3e06826cb5f81e6
f5faa1f9d476120a03f1a187f2f9814adf698fa9c0123ed44a2b5ce9ad8055bd
571890d2bedd6cc0cdf6cccc2e6fc4e19c7489adc30328c24d21e3631d24661e
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
1163575e23a6d7ed4eaa8abc2912a0f4e91fbdaedbf12c97412f941e585b5e9e
MD5 hash:
40152ecc5ecfdff3c372998ea1fa24f9
SHA1 hash:
d9054cad70a989b4d81be6fa846dfbc9989c0fef
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
SH256 hash:
037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f
MD5 hash:
f96cf5405f122cc40d943d0399ed7bc7
SHA1 hash:
74e2706e79d880cd5ba8e5c42368b6fdeee96bec
Link:
https://www.unpac.me/results/6ac3d1b3-3bee-4783-a86b-3a2a8d03b8f1/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/037e60b0e473/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 037e60b0e473203e85de83344c643623b519c8b47279f9e6c0b74201ece7483f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2676319/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/406425/

Comments