MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 039de216dbdc8232a2235d2bd6b69ba4d3c43569e8547479051939c0fe16b775. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 039de216dbdc8232a2235d2bd6b69ba4d3c43569e8547479051939c0fe16b775
SHA3-384 hash: e72a9d26193c0bdd5efeb1bd40690211616a006b2b2a41b9315f8b9a4c7e3f72133c9b43be5e21e71bede1fc3563bb18
SHA1 hash: bff0bf703c756b0a91680b80cf956d69f27034c8
MD5 hash: d25a1039e68ffc771d159c9a30477fa6
humanhash: texas-oscar-wyoming-south
File name:d25a1039e68ffc771d159c9a30477fa6.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:418'963 bytes
First seen:2023-10-25 15:39:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:Z8LxBh19ISTRGWTEV56M62tLanqisvjqKxdYRfXjHkh2GvJCws8vAfm2ajO+f6L8:gLfTRq56MTtmKvj2OhPXjOUYACa
Threatray 8 similar samples on MalwareBazaar
TLSH T1EE94120D3A63ACE2CDD60B74143E7F38F23CAC0502A1698753D0ED7FAA7384A6B551A5
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 70e8d4d6d6d4d4d4 (10 x Formbook)
Reporter smica83
Tags:exe FormBook HUN

Intelligence

File Origin
# of uploads :
1
# of downloads :
338
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
d25a1039e68ffc771d159c9a30477fa6.exe
Verdict:
Malicious activity
Analysis date:
2023-10-25 15:40:16 UTC
Tags:
formbook xloader stealer spyware
Link:
https://app.any.run/tasks/a46c19ba-1488-4332-9d48-2e89e5a639ff

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/456309/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.63317.18365.7981.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a custom TCP request
Сreating synchronization primitives
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
89%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/653936d472356e4f29e6c743/reports/ea24c1e5-1eae-4695-8bea-39b6f49e523a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/039de216dbdc8232a2235d2bd6b69ba4d3c43569e8547479051939c0fe16b775
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Conti
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/403b2148-d17c-40a4-a894-5f92cd60acf0
Result
Threat name:
FormBook, NSISDropper
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1331996
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected FormBook
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1331996 Sample: RL6ezYS06W.exe Startdate: 25/10/2023 Architecture: WINDOWS Score: 100 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus / Scanner detection for submitted sample 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 2 other signatures 2->42 10 RL6ezYS06W.exe 17 2->10         started        process3 file4 30 C:\Users\user\AppData\Local\Temp\syldm.exe, PE32 10->30 dropped 13 syldm.exe 10->13         started        process5 signatures6 46 Antivirus detection for dropped file 13->46 48 Multi AV Scanner detection for dropped file 13->48 50 Detected unpacking (changes PE section rights) 13->50 52 3 other signatures 13->52 16 syldm.exe 13->16         started        process7 signatures8 32 Maps a DLL or memory area into another process 16->32 34 Queues an APC in another process (thread injection) 16->34 19 CacRNxvpCjvZd.exe 16->19 injected process9 process10 21 cmstp.exe 19->21         started        24 autofmt.exe 19->24         started        signatures11 44 Maps a DLL or memory area into another process 21->44 26 explorer.exe 3 1 21->26 injected 28 CacRNxvpCjvZd.exe 21->28 injected process12
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/039de216dbdc8232a2235d2bd6b69ba4d3c43569e8547479051939c0fe16b775
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/039de216dbdc8232a2235d2bd6b69ba4d3c43569e8547479051939c0fe16b775/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-10-25 07:28:02 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
22 of 23 (95.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aoo6efw33sbdfirdluv5nnu3utj4inlj5bkhi6ifde44b7qww52q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
55a96d9729da08198d041dbc860ab75c08a1b2004aea757cadf526cdc128818d
Formbook
5c925c5eae4683e5f9bb2c97974f3443b64e1c68b30ebc2c104dc450b58ab6e3
Formbook
63cc8352a09c3f9c3abb131f79dedc5e8105780787aaf510885544271a30d86a
Formbook
b3b9ce5bdb8e99a149c06df8f09c2809a42b6ad7b251356fd6f4c42cf8214c7a
Formbook
e03d56056800fe8def4ac90dc6067d655aa853f8a37d7ff78f592b99a83d1e5e
Formbook
eb6639834b1b3fda93dc52d164f7d11f500188cd959810cf4c2f3b22eea1dde1
Formbook
fe10370b84feed9cdf222a19005a5f24b5ffa62e559acab7fbc00cdb3b0c9ba7
Formbook
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/231025-s37elabg4z/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Unpacked files
SH256 hash:
039de216dbdc8232a2235d2bd6b69ba4d3c43569e8547479051939c0fe16b775
MD5 hash:
d25a1039e68ffc771d159c9a30477fa6
SHA1 hash:
bff0bf703c756b0a91680b80cf956d69f27034c8
Link:
https://www.unpac.me/results/f3d0182c-3cc3-4a3e-a62c-084d472db37e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/039de216dbdc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/039de216dbdc8232a2235d2bd6b69ba4d3c43569e8547479051939c0fe16b775

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/456309/

Comments