MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3
SHA3-384 hash: 3a222538494de09538323ec8102025e5bf091e21b1b87418337be9bc410c2d28bccabb63149558d22e832000f6afc614
SHA1 hash: ca4ce260def07bc2a0158208aa1f9362499764f4
MD5 hash: 9e621dabf65534dfc620eb0c70f6b7a4
humanhash: minnesota-nine-california-ceiling
File name:9e621dabf65534dfc620eb0c70f6b7a4
Download: download sample
Signature Formbook
Create hunting rule
File size:656'384 bytes
First seen:2023-09-07 09:41:43 UTC
Last seen:2023-09-07 12:34:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:F5fVsbR2Vc+sYaYMWFgSPOQgxArMdAbF3GgFIgZvE+7kbuG1OfOo:FtO27VSSmQgxsMdAM7gZWO
Threatray 44 similar samples on MalwareBazaar
TLSH T10DD4E0F91426C7EAD37493FF54A794308A63BC64613056ECB77D32980EAABD31902D72
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9e621dabf65534dfc620eb0c70f6b7a4
Verdict:
Suspicious activity
Analysis date:
2023-09-07 09:42:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/340d4050-c7e5-478b-a914-1db4ed641027

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/447006/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64f99af1b7dd6394f71269ff/reports/b98fd686-c143-4e0d-9b30-eab6b4823fda/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5cc854d6-bf21-4885-8f19-1ab41bafb04a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1305733
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1305733 Sample: 4cYoKvBqQ2.exe Startdate: 07/09/2023 Architecture: WINDOWS Score: 100 31 www.autoreediritto.com 2->31 33 autoreediritto.com 2->33 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 4 other signatures 2->47 10 4cYoKvBqQ2.exe 3 2->10         started        signatures3 process4 signatures5 57 Injects a PE file into a foreign processes 10->57 13 4cYoKvBqQ2.exe 10->13         started        16 4cYoKvBqQ2.exe 10->16         started        process6 signatures7 61 Maps a DLL or memory area into another process 13->61 63 Queues an APC in another process (thread injection) 13->63 18 DXkBuQgoNnz.exe 13->18 injected process8 process9 20 cmstp.exe 13 18->20         started        23 autochk.exe 18->23         started        signatures10 49 Tries to steal Mail credentials (via file / registry access) 20->49 51 Tries to harvest and steal browser information (history, passwords, etc) 20->51 53 Modifies the context of a thread in another process (thread injection) 20->53 55 Maps a DLL or memory area into another process 20->55 25 explorer.exe 1 20->25 injected 29 DXkBuQgoNnz.exe 20->29 injected process11 dnsIp12 35 shahaf3d.com 64.46.118.12, 49747, 80 SINGLEHOP-LLCUS United States 25->35 37 www.aiysmao.com 154.204.199.206, 49749, 49750, 49751 COMING-ASABCDEGROUPCOMPANYLIMITEDHK Seychelles 25->37 39 www.shahaf3d.com 25->39 59 System process connects to network (likely due to code injection or exploit) 25->59 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3/
Threat name:
Win32.Trojan.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-09-07 09:42:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dfsfzjqkedy5phh3wfz5rqeauy65wgg3oneyvc7h5t5ojvgx4hjq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
32119baabd1fab988ebaf2f5692f46c797902e94b52729c27f30f8e579feb530
Formbook
66e9b5aad3bc2d59cdabefdfeecff99d0e60fd9d65ae7cd60d8a8db80adf48cc
Formbook
75a5d5d46fa6c5178a43eea7c2d4d0bb66dd6879413318416dd70b4ef27faee8
Formbook
794b5731c293822cc916b19f0e7dd93d86b05a58afb7aff39255939953ae17d0
Formbook
8ac567bfb4be359b1136e1236bbdbac3e160077a89952f967467a345a23c0047
Formbook
98bce22d33a7e23bf5a32739d01c10443509da758e81b57d26bcc1fcfeb3861f
Formbook
ac254c8f30ac538efa1c6774d3b7e6a1b379af081c6cb15d36440e4913bc41c1
Formbook
fd39da24e0cecd5d485b4242854f6111a89b0a9359639a1c3c0abb87b75fffb1
Formbook
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230907-lpb8zagc7w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
b3b4654e5b85e411fdf00c7fab359f62b477b7163ba1c8215f430f868c8446cd
MD5 hash:
1ac1feed577739f3d8750043de6170b9
SHA1 hash:
56fc271225848860804a702ceabb237ec7d919a2
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
12dbcdd521c33f187afcd9cf6ede398f0e98045f9c58b27429bd539dcc5b9c89
MD5 hash:
6466d7a820896c44cc06eb47b5770ec6
SHA1 hash:
5f16f954e836db5cca60b546b8ade0dabeb9b9da
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
9cff2337fea74ca07b87c13c84ff32600dbe989036e9b95a116de87c6c2b6d83
MD5 hash:
5824dd660674f71af29ea09a865790b6
SHA1 hash:
f8ffa993105882182c156b023b6ba3c8865a8a74
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
8d8c5c52ce5d8c82f223ff0f3fb785f47df2db2d9894ffbe024b310775c6a13f
MD5 hash:
ec7f0b58950b129054efeac2b74c201e
SHA1 hash:
55b22738572cfeb7f73415357554c74e3da96d72
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
0630b864e828fff2d66f33ab7d00fad231df4c00fc0bbad313ee0d12ca503198
MD5 hash:
f559a9abbd849eb977d262d597d6e4fd
SHA1 hash:
0a8769b40b026852690c89b913c2812817ef43c8
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
Parent samples :
cef72412a1dd9486bae5f7e606d4330660fba98575ba1c939559ccc83536f41a
81ccf158093718305b3499d0f16d8a82bcad69f2740066daca8d5b5ca9979688
SH256 hash:
edbb66528ead36bb096c1d3097088201d72e764668b68552d5f6b264dc25105b
MD5 hash:
95e0246c0973580bc12d416ebdffda50
SHA1 hash:
b0fe27289fa843ba74ac6374764730ad9b2b5683
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
edfebb1dfb93d28eb32a3a3e6564a027d0ba1873e6cf6b183715d30d284021fe
MD5 hash:
52d805983d0975183ee10bd5845336e8
SHA1 hash:
a9dc62ea1c1a613b2315b3a6690781dc7ab211d4
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
d236a4b29e639ec52fe04cf6087c304d37f4de642eee43a6983e4d8eb0bb5059
MD5 hash:
1323f9d98b31fa7a8bb9825313b2aefd
SHA1 hash:
851d625f9590d58ba243dcb5f75a87300df456f7
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
2daa663dafe3d34bde28b69c90d6e367702ff16807f24626caa5cb49a9436abc
MD5 hash:
901de35fd8401a0d2dfc8634bb670518
SHA1 hash:
8115b733d36cf20f4c51c8956afab7280ab6386d
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
78bdc376c1ab3568914b8bcda478676b6c724aa257ae26c7515562e25a99329a
MD5 hash:
4d25a442d33616954227c866bc320875
SHA1 hash:
792f9b183d1587c4e00a371380867879846b2bbf
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
f29f8aa8ddc6db6b21b61f7c687846ef5d6eabc94669751972d28655c8808b5c
MD5 hash:
3cc1ed5715ae8dcd43ea968de177dbb8
SHA1 hash:
1324cda06f20623affe1da4253c6d56be5797eb6
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
SH256 hash:
19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3
MD5 hash:
9e621dabf65534dfc620eb0c70f6b7a4
SHA1 hash:
ca4ce260def07bc2a0158208aa1f9362499764f4
Link:
https://www.unpac.me/results/cc1cdfc2-3cb7-4d86-bd19-86e6757e7fd5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2710224/
Cape
Cape
https://www.capesandbox.com/analysis/447006/

Comments


Avatar
zbet commented on 2023-09-07 09:41:44 UTC

url : hxxp://80.76.51.248/kenpol.exe