MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 18c5a2b418c466198a812c3c1cf4d45e85b2db2acba84739d4ab4e299814caf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 18c5a2b418c466198a812c3c1cf4d45e85b2db2acba84739d4ab4e299814caf5 |
|---|---|
| SHA3-384 hash: | 15c0770a65d999a00e8f0bd502f7099e77f9900f762b4bf15ee8da58c8d9cf7d760e864b17e0bc1a9ad0b5d3df5a795a |
| SHA1 hash: | 4ae2ce6c2dc07aa42aace408bd03afe85ccd913c |
| MD5 hash: | 6a6ec075b935a1811919079b6645e38f |
| humanhash: | item-lima-tennessee-papa |
| File name: | 6a6ec075b935a1811919079b6645e38f |
| Download: | download sample |
| Signature | Formbook |
| File size: | 879'104 bytes |
| First seen: | 2023-02-15 04:44:04 UTC |
| Last seen: | 2023-02-15 06:29:44 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:xHCtn9BoO/N+SQlQXDv1jclC3CNcqZRWOsICqvf5xGZ5ZG52e9O:2QK5cljc0RWT8vfHw5Q2e9 |
| TLSH | T17615F15C2CB48315C1ACC2FE86E36634E37FBE93B589D6190D9671CA0C747E3609899B |
| TrID | 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.8% (.SCR) Windows screen saver (13097/50/3) 8.7% (.EXE) Win64 Executable (generic) (10523/12/4) 5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6a6ec075b935a1811919079b6645e38f
Verdict:
Malicious activity
Analysis date:
2023-02-15 04:48:15 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-02-10 10:31:00 UTC
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
6bbe29beded7a01a6c0cb4a45dbda2ab26f6eb2935ab66b29f363b1509ac0519
MD5 hash:
ed640a21e80200ff069bee1cd1315fd3
SHA1 hash:
a474f8d43ddac4e0437ac83c62573bf1c5bf6f5a
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
Parent samples :
3e0cdcdaa9cf3c06e4f5c28a4d7878f8bd60265f2b7e9a8eb88a6f13b75435b7
e084bbd5502e2fe6fd3ac6ad41fc88f2d09ffc89d24e8d34107c83db76d0ff98
18c5a2b418c466198a812c3c1cf4d45e85b2db2acba84739d4ab4e299814caf5
3a660d27e5c230dc07725cde5222c679ca2b402835395815ca28ac5334b8b6f1
f34101ff83317586693f070a42c11d7e09f5588f4748258830f5475b3ebf227d
e084bbd5502e2fe6fd3ac6ad41fc88f2d09ffc89d24e8d34107c83db76d0ff98
18c5a2b418c466198a812c3c1cf4d45e85b2db2acba84739d4ab4e299814caf5
3a660d27e5c230dc07725cde5222c679ca2b402835395815ca28ac5334b8b6f1
f34101ff83317586693f070a42c11d7e09f5588f4748258830f5475b3ebf227d
SH256 hash:
5cce4d18007b6fb8cf3377c795dcfebb18cc3b5dabc11b09334c8ed7191231b3
MD5 hash:
b3843c7b674a2ebaf1e0f5907c847094
SHA1 hash:
639b742aeb8fd1c34c0b90d677ac259fcd5f899a
SH256 hash:
ffc572b9fbc00f8c8ed2e3bacf101d5093b41a839026368981cebac3d15b9ea6
MD5 hash:
bce9fd0b16d3359bb341b6de7041f73c
SHA1 hash:
03c3cdd126cffe61cf2c25aea58fbfe08cfd8319
SH256 hash:
4197cbee1fe8774f351ba9bb522cf9d7230f961098782717be7ef9b00b1404a9
MD5 hash:
91166106e57a2050c4dae8fb7ab38132
SHA1 hash:
985aef55c316fbae62f63ae90b52240e88e61626
SH256 hash:
46cb32256dba295b72212185d3bf29e54de9f78fe32a8e43c82288285c3bf721
MD5 hash:
453d8d23d417dacecac4ad0235d2b420
SHA1 hash:
6aaffef79f32f151aef9d5c548ac9055ea6c2f35
SH256 hash:
8617cea503c2a3961120a9c503d853bc21d38d1fca7143d6b1ef4f388bc5cec7
MD5 hash:
7f225c69df031bf0560aed3847a1221a
SHA1 hash:
4d5f3ccdb2c6015d2b2a73326c0f32b173af2819
SH256 hash:
18c5a2b418c466198a812c3c1cf4d45e85b2db2acba84739d4ab4e299814caf5
MD5 hash:
6a6ec075b935a1811919079b6645e38f
SHA1 hash:
4ae2ce6c2dc07aa42aace408bd03afe85ccd913c
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://103.170.254.253/googlesave/vbc.exe