MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13729adf9d5d63528bc95299f6fa400dcd3330dd4b2c00cb1fb1b28112ece9de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13729adf9d5d63528bc95299f6fa400dcd3330dd4b2c00cb1fb1b28112ece9de
SHA3-384 hash: 348007abe7ace253c60c86caef39b6f5b1fd78c4181b0fb50113fbce969d0b491f9ed94029f874e439ccd9c6ed9faba7
SHA1 hash: 3694f249a947384ad1ef3b9d702c6c9fc39d5106
MD5 hash: 0f82fb1af7e47cfdf486e08e05e05782
humanhash: stream-six-salami-glucose
File name:13729adf9d5d63528bc95299f6fa400dcd3330dd4b2c00cb1fb1b28112ece9de
Download: download sample
Signature Formbook
Create hunting rule
File size:655'872 bytes
First seen:2023-09-08 10:10:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:q2WJp09jxyrO8SywaP8FDhImyBzSfzaVvAIyt0VY3q7a1CvprWIFIKVBY:q2F9gvX8FNSBzSfzaVvAIdY3/1CvprJB
Threatray 60 similar samples on MalwareBazaar
TLSH T1EAD40213FE16EB7DC03F8BFA3C11910506A2EE1E6864E7589A5A75F26C32713843DA17
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
13729adf9d5d63528bc95299f6fa400dcd3330dd4b2c00cb1fb1b28112ece9de
Verdict:
Suspicious activity
Analysis date:
2023-09-08 10:10:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/de9c7380-f10a-4854-b8c5-7474bc3e52e7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/447388/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64faf33586964ed9c614e6c0/reports/833c10e0-0120-4f59-a56f-6009ad9f2bd5/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/13729adf9d5d63528bc95299f6fa400dcd3330dd4b2c00cb1fb1b28112ece9de
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5e7df1ab-310a-4f9f-a801-d6a4205617c7
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1306046
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Deletes itself after installation
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13729adf9d5d63528bc95299f6fa400dcd3330dd4b2c00cb1fb1b28112ece9de/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-08-28 10:32:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnzjvx45lvrvfc6jkkm7n6sabxgtgmg5jmwabsy7wgzicexm5hpa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
039bf6fc7dfbdaede3058b77c9e156f241f7d3a45f6ce97c852a0c594fb6adca
Formbook
358659e950dae1b469fca25fb75167cae886174d21a9226fd8081fbd71d5abbc
Formbook
5762d46e91e94d731bb4f1047a3d080b27be1b34d05236e8c8f24b24238545fd
Formbook
8316df0c425a49849eaf0c55fac307ea3ac82efa3a83b3ea786fd63e8b38b909
Formbook
845adc24e3235ebe41dd0d7f8c3b044a5c485e89af4adb60404c4ac915dcad21
Formbook
8c305a8516089a9e811fbc9cf560b0e36a2494debe59c5677376638c7155a452
Formbook
9c8bd9485bb9039e6c2f0bb765ac58131c478b32419643405378bdbb4eb30547
Formbook
bd03f21ffe0e1b5628a0f890aeb7c186e2330a4e59e554f675fee7994ed3ea5d
Formbook
ccc8ed7866ebf89380c45861e50f095db3acf900fa4cf797e1a5de78cf6051aa
Formbook
fd82749104473f4be5f7498f2a751f4090f999c50ae63e114ea49067c2b16185
Formbook
+ 50 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230908-l7xmmaaf87/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
5195fe0473c163c1a8b40d42f3f9d656522292c4e717d889e5049e5be42e8e24
MD5 hash:
59bafb0d1b450fd07efbdbfa75ec792f
SHA1 hash:
54892afc95f484afe904d5201b1658008681d76a
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/1124ce90-b4f6-47c0-a7b3-306b7686381a/
SH256 hash:
468dc08d471b173b923cc6477c32204b4f5b172f3be85e4d023bd9b8b688f232
MD5 hash:
1a86245a5d6ccacc2dd1881f921ec64c
SHA1 hash:
d5af6044f3295af599cd195855a26c26f96379c2
Link:
https://www.unpac.me/results/1124ce90-b4f6-47c0-a7b3-306b7686381a/
SH256 hash:
85a25f15a2982ab7a5333fb870437da1f0c201fbe6af78a4a1dc04f42f2b4844
MD5 hash:
86a19e5bcb4e4ee87ce6213c1bc9aa4a
SHA1 hash:
efc45ff719f767986a8ab412f458f63a3d28b96f
Link:
https://www.unpac.me/results/1124ce90-b4f6-47c0-a7b3-306b7686381a/
SH256 hash:
2ac2f55e15fd8da559f99925ceee9166ca978e94cbc53a5cb29bf02d0a76ac7f
MD5 hash:
1081db0b25581c7958e6fbff4d9aa64a
SHA1 hash:
bcb0e0fe844884a5b0d05cd3b0cc5fd7a5ff53b9
Link:
https://www.unpac.me/results/1124ce90-b4f6-47c0-a7b3-306b7686381a/
SH256 hash:
30cd1c842c0cc9c62af0518a5fd44cb4ec7cb596d1a1e1e75d66c8d90a6dc5be
MD5 hash:
36ddb60488c522781af1502386caaa8d
SHA1 hash:
7dbe57a6342fc71b9aee41358bb9a71d68423782
Link:
https://www.unpac.me/results/1124ce90-b4f6-47c0-a7b3-306b7686381a/
SH256 hash:
13729adf9d5d63528bc95299f6fa400dcd3330dd4b2c00cb1fb1b28112ece9de
MD5 hash:
0f82fb1af7e47cfdf486e08e05e05782
SHA1 hash:
3694f249a947384ad1ef3b9d702c6c9fc39d5106
Link:
https://www.unpac.me/results/1124ce90-b4f6-47c0-a7b3-306b7686381a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/13729adf9d5d63528bc95299f6fa400dcd3330dd4b2c00cb1fb1b28112ece9de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/447388/

Comments