MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
SHA3-384 hash: cbf629a76b6302af03ccb7086ee21fc6e21000a1cdb104cedf5ec2f9d3aecd1bc1884640bd45f08912c81d3463d10234
SHA1 hash: 75c34ce60cdaf23110ea7a3c0fce158073408eb0
MD5 hash: e6195fd5e34ef77e3cb1bbd4595b671d
humanhash: jersey-violet-eight-undress
File name:16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
Download: download sample
Signature Formbook
Create hunting rule
File size:858'112 bytes
First seen:2023-07-05 13:12:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:rMgcKHlWxMiQW/O4ue7Tt0LCMSpwjpaCqufNFAhV6ji:VnlYMiQWmS7TQwwjpn/V2hui
Threatray 3'341 similar samples on MalwareBazaar
TLSH T11605F11862FADB1AE4BE7FFC0880917143F1525A7516E78A4ED374DA5E70F018F019AB
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon e08c0f2322073bc0 (10 x AgentTesla, 6 x Formbook, 3 x SnakeKeylogger)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
Verdict:
No threats detected
Analysis date:
2023-07-05 13:10:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b24c9ab9-5fc4-4599-b42c-80d83583dcf8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/407696/
Detection(s):
Win.Dropper.Nanocore-10004225-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
floxif lokibot packed virus
Link:
https://www.filescan.io/uploads/64a56c5e9d2b91874b4437ef/reports/50a58bf9-d553-46c6-a255-997d0514ee33/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/78d6f083-a2aa-4909-a0d6-73df4f8e1f6a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1267273
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1267273 Sample: uE6gomQeZK.exe Startdate: 05/07/2023 Architecture: WINDOWS Score: 100 33 www.digitalworldobserver.com 2->33 41 Snort IDS alert for network traffic 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 6 other signatures 2->47 11 uE6gomQeZK.exe 3 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\uE6gomQeZK.exe.log, ASCII 11->31 dropped 57 Tries to detect virtualization through RDTSC time measurements 11->57 59 Injects a PE file into a foreign processes 11->59 15 uE6gomQeZK.exe 11->15         started        18 uE6gomQeZK.exe 11->18         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 20 explorer.exe 1 15->20 injected process9 dnsIp10 35 www.glchqx.com 156.230.162.56, 49700, 80 ITACE-AS-APItaceInternationalLimitedHK Seychelles 20->35 37 td-ccm-168-233.wixdns.net 34.117.168.233, 49701, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 20->37 39 3 other IPs or domains 20->39 49 System process connects to network (likely due to code injection or exploit) 20->49 24 svchost.exe 20->24         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 24->51 53 Maps a DLL or memory area into another process 24->53 55 Tries to detect virtualization through RDTSC time measurements 24->55 27 cmd.exe 1 24->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44/
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2023-06-05 14:02:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
28 of 37 (75.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c26ynddmeiaimsbf3zyysluialypp4sd6r3nzu4otvytxmff5zca._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2c4d743879afbbe0b4baa18e99e515a8b0586caf23308026e233c2031e69237c
Formbook
41ab6054625f7a03d1a0af44403ac248ca880ddc0141f61e41755b6f2263e42a
Formbook
4baabf9e31ff1f2fec8fa4f3165d5456836c307591bf8840ec5a8074759fe742
Formbook
89dc8c98551c4f2b309fd2807b8bf1d24e1c2abd953930f95b5aa1987e0966f2
Formbook
9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09
Formbook
b81b5d7a927299cc54748988d70523c615e82e21482652510a1a95db89b3521d
Formbook
bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02
Formbook
e40bff3bb093b2bdc11d7e1d5a990db99b3a914dc74a1aec2d28662da10cde9b
Formbook
e8cb5925478cdb28bba3e7c553ebc3bd1a3e292d83af4c16a8bfd14a7d20b05f
Formbook
+ 3'331 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ks01 rat spyware stealer trojan
Link:
https://tria.ge/reports/230705-qf3f1sce46/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook payload
Formbook
Unpacked files
SH256 hash:
335a8639aa88b194512bbd5dd4739d60304a0841d4f3490f7583fd9edb6707c1
MD5 hash:
9674e3b4cffbfd378cb384d02b7939e9
SHA1 hash:
ac75de7840ea193007bad71ada6a4f2c2a06979b
Detections:
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
Parent samples :
bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02
b81b5d7a927299cc54748988d70523c615e82e21482652510a1a95db89b3521d
9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09
89dc8c98551c4f2b309fd2807b8bf1d24e1c2abd953930f95b5aa1987e0966f2
4baabf9e31ff1f2fec8fa4f3165d5456836c307591bf8840ec5a8074759fe742
2c4d743879afbbe0b4baa18e99e515a8b0586caf23308026e233c2031e69237c
16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
581a4f34ba7db66e569d2d9135f8e73e089ed3bc4654c2e5099baf6854166021
324dcadf47a0c3085f54a7cfc51b512562ff907c953862e792356334b8fa74d8
SH256 hash:
2f13f4db3405dfac3dd2945be3de440607b6e8479951c2630823009700083953
MD5 hash:
084fd7e237ece48508277cdfd578e47d
SHA1 hash:
f152839ca9518552e41320c8b3bab96d01a911e5
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
deafae08eeb251b2123ae550003b25d240c148120ee14b4bce01de5ad7a0908d
MD5 hash:
51da62789f6ae84d5191a6b1d19c88f1
SHA1 hash:
890b583bc118d1c4d5d311042eeacac422eb13ac
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
86ef279177f3f0b359b4087453b8da324a0c8482aabc58a0996a34048f10a47c
MD5 hash:
acfe6aac172ebb1f48de8f8bb1027ff4
SHA1 hash:
8328977c44fe1b968d469fc3d89cbf66f33fac9b
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
335a8639aa88b194512bbd5dd4739d60304a0841d4f3490f7583fd9edb6707c1
MD5 hash:
9674e3b4cffbfd378cb384d02b7939e9
SHA1 hash:
ac75de7840ea193007bad71ada6a4f2c2a06979b
Detections:
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
Parent samples :
bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02
b81b5d7a927299cc54748988d70523c615e82e21482652510a1a95db89b3521d
9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09
89dc8c98551c4f2b309fd2807b8bf1d24e1c2abd953930f95b5aa1987e0966f2
4baabf9e31ff1f2fec8fa4f3165d5456836c307591bf8840ec5a8074759fe742
2c4d743879afbbe0b4baa18e99e515a8b0586caf23308026e233c2031e69237c
16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
581a4f34ba7db66e569d2d9135f8e73e089ed3bc4654c2e5099baf6854166021
324dcadf47a0c3085f54a7cfc51b512562ff907c953862e792356334b8fa74d8
SH256 hash:
2f13f4db3405dfac3dd2945be3de440607b6e8479951c2630823009700083953
MD5 hash:
084fd7e237ece48508277cdfd578e47d
SHA1 hash:
f152839ca9518552e41320c8b3bab96d01a911e5
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
deafae08eeb251b2123ae550003b25d240c148120ee14b4bce01de5ad7a0908d
MD5 hash:
51da62789f6ae84d5191a6b1d19c88f1
SHA1 hash:
890b583bc118d1c4d5d311042eeacac422eb13ac
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
86ef279177f3f0b359b4087453b8da324a0c8482aabc58a0996a34048f10a47c
MD5 hash:
acfe6aac172ebb1f48de8f8bb1027ff4
SHA1 hash:
8328977c44fe1b968d469fc3d89cbf66f33fac9b
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
335a8639aa88b194512bbd5dd4739d60304a0841d4f3490f7583fd9edb6707c1
MD5 hash:
9674e3b4cffbfd378cb384d02b7939e9
SHA1 hash:
ac75de7840ea193007bad71ada6a4f2c2a06979b
Detections:
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
Parent samples :
bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02
b81b5d7a927299cc54748988d70523c615e82e21482652510a1a95db89b3521d
9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09
89dc8c98551c4f2b309fd2807b8bf1d24e1c2abd953930f95b5aa1987e0966f2
4baabf9e31ff1f2fec8fa4f3165d5456836c307591bf8840ec5a8074759fe742
2c4d743879afbbe0b4baa18e99e515a8b0586caf23308026e233c2031e69237c
16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
581a4f34ba7db66e569d2d9135f8e73e089ed3bc4654c2e5099baf6854166021
324dcadf47a0c3085f54a7cfc51b512562ff907c953862e792356334b8fa74d8
SH256 hash:
2f13f4db3405dfac3dd2945be3de440607b6e8479951c2630823009700083953
MD5 hash:
084fd7e237ece48508277cdfd578e47d
SHA1 hash:
f152839ca9518552e41320c8b3bab96d01a911e5
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
deafae08eeb251b2123ae550003b25d240c148120ee14b4bce01de5ad7a0908d
MD5 hash:
51da62789f6ae84d5191a6b1d19c88f1
SHA1 hash:
890b583bc118d1c4d5d311042eeacac422eb13ac
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
86ef279177f3f0b359b4087453b8da324a0c8482aabc58a0996a34048f10a47c
MD5 hash:
acfe6aac172ebb1f48de8f8bb1027ff4
SHA1 hash:
8328977c44fe1b968d469fc3d89cbf66f33fac9b
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
335a8639aa88b194512bbd5dd4739d60304a0841d4f3490f7583fd9edb6707c1
MD5 hash:
9674e3b4cffbfd378cb384d02b7939e9
SHA1 hash:
ac75de7840ea193007bad71ada6a4f2c2a06979b
Detections:
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
Parent samples :
bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02
b81b5d7a927299cc54748988d70523c615e82e21482652510a1a95db89b3521d
9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09
89dc8c98551c4f2b309fd2807b8bf1d24e1c2abd953930f95b5aa1987e0966f2
4baabf9e31ff1f2fec8fa4f3165d5456836c307591bf8840ec5a8074759fe742
2c4d743879afbbe0b4baa18e99e515a8b0586caf23308026e233c2031e69237c
16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
581a4f34ba7db66e569d2d9135f8e73e089ed3bc4654c2e5099baf6854166021
324dcadf47a0c3085f54a7cfc51b512562ff907c953862e792356334b8fa74d8
SH256 hash:
2f13f4db3405dfac3dd2945be3de440607b6e8479951c2630823009700083953
MD5 hash:
084fd7e237ece48508277cdfd578e47d
SHA1 hash:
f152839ca9518552e41320c8b3bab96d01a911e5
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
deafae08eeb251b2123ae550003b25d240c148120ee14b4bce01de5ad7a0908d
MD5 hash:
51da62789f6ae84d5191a6b1d19c88f1
SHA1 hash:
890b583bc118d1c4d5d311042eeacac422eb13ac
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
86ef279177f3f0b359b4087453b8da324a0c8482aabc58a0996a34048f10a47c
MD5 hash:
acfe6aac172ebb1f48de8f8bb1027ff4
SHA1 hash:
8328977c44fe1b968d469fc3d89cbf66f33fac9b
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
335a8639aa88b194512bbd5dd4739d60304a0841d4f3490f7583fd9edb6707c1
MD5 hash:
9674e3b4cffbfd378cb384d02b7939e9
SHA1 hash:
ac75de7840ea193007bad71ada6a4f2c2a06979b
Detections:
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
Parent samples :
bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02
b81b5d7a927299cc54748988d70523c615e82e21482652510a1a95db89b3521d
9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09
89dc8c98551c4f2b309fd2807b8bf1d24e1c2abd953930f95b5aa1987e0966f2
4baabf9e31ff1f2fec8fa4f3165d5456836c307591bf8840ec5a8074759fe742
2c4d743879afbbe0b4baa18e99e515a8b0586caf23308026e233c2031e69237c
16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
581a4f34ba7db66e569d2d9135f8e73e089ed3bc4654c2e5099baf6854166021
324dcadf47a0c3085f54a7cfc51b512562ff907c953862e792356334b8fa74d8
SH256 hash:
2f13f4db3405dfac3dd2945be3de440607b6e8479951c2630823009700083953
MD5 hash:
084fd7e237ece48508277cdfd578e47d
SHA1 hash:
f152839ca9518552e41320c8b3bab96d01a911e5
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
deafae08eeb251b2123ae550003b25d240c148120ee14b4bce01de5ad7a0908d
MD5 hash:
51da62789f6ae84d5191a6b1d19c88f1
SHA1 hash:
890b583bc118d1c4d5d311042eeacac422eb13ac
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
86ef279177f3f0b359b4087453b8da324a0c8482aabc58a0996a34048f10a47c
MD5 hash:
acfe6aac172ebb1f48de8f8bb1027ff4
SHA1 hash:
8328977c44fe1b968d469fc3d89cbf66f33fac9b
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
SH256 hash:
16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44
MD5 hash:
e6195fd5e34ef77e3cb1bbd4595b671d
SHA1 hash:
75c34ce60cdaf23110ea7a3c0fce158073408eb0
Link:
https://www.unpac.me/results/ce3aae29-f5b0-4c07-a0ba-8526b64f3e38/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/16bd868c6c22/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/16bd868c6c2200864825de71892e8802f0f7f243f476dcd38e9d713bb0a5ee44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/407696/

Comments