MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16254f6bd729c3e6c6703bdaf72a384161a61b631f808c1d6329f2dd1e4223db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16254f6bd729c3e6c6703bdaf72a384161a61b631f808c1d6329f2dd1e4223db
SHA3-384 hash: 68b9f47446fc91bdd96d77151a0ae7bb623d33457c9570d50179eca121f5ea46bce54ea2533c9cbfe733404793270932
SHA1 hash: 5e488edbecf3a3a4d32b4327fc593d8579a6f2a5
MD5 hash: b45043fd5f1b19b2633c8b08f5b7e1c5
humanhash: social-whiskey-pluto-september
File name:b45043fd5f1b19b2633c8b08f5b7e1c5.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:785'990 bytes
First seen:2021-02-18 16:02:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:hMTgVvyhiAeIuNAotC0COoiEUnsP8eu0yQB0q70A//YuT9HbvD4MFL4Wver:hM8VvGeIup/oNMO0q70ALHbvD4WL4Wq
TLSH 83F4BF6223C57B44D47E5B748120790083F3F5AEE779C64E7CD820DA6B32BC1A6A7792
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/117838/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.528.12312.451.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/611830
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16254f6bd729c3e6c6703bdaf72a384161a61b631f808c1d6329f2dd1e4223db/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 16:02:15 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cysu626xfhb6nrtqhpnpokryifq2mg3dd6aiyhldfhzn2hscepnq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210218-8csr96k33x/
Unpacked files
SH256 hash:
16254f6bd729c3e6c6703bdaf72a384161a61b631f808c1d6329f2dd1e4223db
MD5 hash:
b45043fd5f1b19b2633c8b08f5b7e1c5
SHA1 hash:
5e488edbecf3a3a4d32b4327fc593d8579a6f2a5
Link:
https://www.unpac.me/results/30691fe5-91ca-4e3e-a580-01872a38df56/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 16254f6bd729c3e6c6703bdaf72a384161a61b631f808c1d6329f2dd1e4223db

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/988852/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117838/

Comments