MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 212a9d67f119355da790e8449b6978f357d46bb671d7e038444ad1eae5995bdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
FormBook
Vendor detections: 13
| SHA256 hash: | 212a9d67f119355da790e8449b6978f357d46bb671d7e038444ad1eae5995bdc |
|---|---|
| SHA3-384 hash: | f9c7fe6e5d3066502c939fb18dbedb27db17e641310338b5aee9dcfcbec9914d8713c182e4f4fed9e5ab31b831477493 |
| SHA1 hash: | 3e81ecad66c7b4d28cf5a177b626564ac20efc50 |
| MD5 hash: | 91ebbf46fb689437665c024e2df7df42 |
| humanhash: | kilo-twelve-cardinal-solar |
| File name: | SecuriteInfo.com.W32.AIDetectNet.01.7358.12992 |
| Download: | download sample |
| Signature | FormBook |
| File size: | 689'664 bytes |
| First seen: | 2022-05-18 13:35:38 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:mBgT05ZXY7Z7072S9E9bPbgb3hANmbfPJAvmdUBXdJ/M3:m40nopS9E9bPbgb3hAYPJ8mdEXd5M3 |
| Threatray | 12'583 similar samples on MalwareBazaar |
| TLSH | T1CDE4F12562A8DD60E96D43FED06251F807716D07D512F74BCFA0BCEA3D363C1861AA2B |
| TrID | 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetectNet.01.7358.12992
Verdict:
Malicious activity
Analysis date:
2022-05-18 23:51:40 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Gathering data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
formbook
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2022-05-18 03:37:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
18 of 41 (43.90%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 12'573 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:e934 rat spyware stealer trojan
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook Payload
Formbook
Unpacked files
SH256 hash:
cdcea37abce473eaaab9c24324e22c63bb581e3b97980d1d73e5ddd426e71897
MD5 hash:
f171b37db36f271c812b067a010446df
SHA1 hash:
3c280176ea2a5ddbee38710889ba890ea8f69d8e
Detections:
win_formbook_g0
win_formbook_auto
Parent samples :
0a4a31c38a5ea9eb589521b2839b995e0270e6dc07405fb27dabd01d18d90b51
1aedec4c789a2833e781fce06c81c709c4c8cef42f9b1fe2a2b61f9bb836cbee
212a9d67f119355da790e8449b6978f357d46bb671d7e038444ad1eae5995bdc
a25f8973ec9af55bd5382cc5e7c9495edcd8a5311d632d607de4c25bb4a12332
60612eca6fac7085f8747d9943939ea995ad836c5cc314fdb283f8e2463672d6
84347c5247f07c3563add6a525c9fae350a5130b062431af0f1646be6c31ee51
1aedec4c789a2833e781fce06c81c709c4c8cef42f9b1fe2a2b61f9bb836cbee
212a9d67f119355da790e8449b6978f357d46bb671d7e038444ad1eae5995bdc
a25f8973ec9af55bd5382cc5e7c9495edcd8a5311d632d607de4c25bb4a12332
60612eca6fac7085f8747d9943939ea995ad836c5cc314fdb283f8e2463672d6
84347c5247f07c3563add6a525c9fae350a5130b062431af0f1646be6c31ee51
SH256 hash:
b113f7c3c7616181ed7c263cc32c31998d67cff034b877ce821b3502d8bff5f1
MD5 hash:
abc57293c086e7ae3e546a31cd689c92
SHA1 hash:
fffee07d7e1db72a3b2f94feb8bf0169bfe16792
SH256 hash:
3719d3bfbedd7e1f0dea86496b6e7a991a37559e3d8279ec10250b6d14487e4c
MD5 hash:
2cb678fc14b6c4eedf3e14873e6be4ce
SHA1 hash:
bca7f2f84ee60c91c76f29f5849aa04583d740c9
SH256 hash:
09602efe05dc6b9738b23b91708978231d20c08329940541a086561795a6c9fd
MD5 hash:
1521132bd568891debf24b4973aaa24e
SHA1 hash:
393fafe43a177d02d2a8be164101fc2add2748dc
SH256 hash:
212a9d67f119355da790e8449b6978f357d46bb671d7e038444ad1eae5995bdc
MD5 hash:
91ebbf46fb689437665c024e2df7df42
SHA1 hash:
3e81ecad66c7b4d28cf5a177b626564ac20efc50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.