MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 293fd960e74b47494bc97ded006d308f638e49d5886e664957331a4d1e67ea7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 293fd960e74b47494bc97ded006d308f638e49d5886e664957331a4d1e67ea7e
SHA3-384 hash: 0e4d9dc434e359d3369c139c900f98f5f8ae7923e43814ae9fdcd274a3add16cb20a8f0332e76333fef118078c9037ab
SHA1 hash: 16a64d853f53da12f91c4d7636c1f05d2e48ad69
MD5 hash: 153a9b72f0a5b0dc08fda0e8b1ae4a31
humanhash: august-saturn-red-thirteen
File name:SecuriteInfo.com.Variant.Barys.5639.17226.1782
Download: download sample
Signature Formbook
Create hunting rule
File size:882'688 bytes
First seen:2023-01-17 20:31:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ev9OWSU29nu0b+NoexY/uzMK/tNxt4mgaj5wDzTHWDgTJEZkJ57Tlh:XU293+NNx8Y/tNBD6LJEaJRTl
TLSH T13D152911DF36C2D9C4784AB097389665E9621F90463CA1AE7E823DAE6CF573B03D8713
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 00ccd0f8f8f0c400 (6 x SnakeKeylogger, 2 x Formbook, 1 x Loki)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Barys.5639.17226.1782
Verdict:
Suspicious activity
Analysis date:
2023-01-17 20:35:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/147d3f97-ca94-4275-98e9-07016875cf86

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/353944/
Detection(s):
SecuriteInfo.com.Variant.Barys.5639.17226.1782.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
75%
Tags:
packed
Link:
https://www.filescan.io/uploads/63c7058dafdaca54d438e025/reports/16824c64-2a55-48e3-a48e-820687e654a7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2aee6bdb-9afb-41b0-ad65-b7555e9bb0a6
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1153465
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/293fd960e74b47494bc97ded006d308f638e49d5886e664957331a4d1e67ea7e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-01-17 17:09:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
40
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fe75syhhjnduss6jpxwqa3jqr5ry4sovrbxgmskxgmne2hth5j7a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230117-zap36sfd46/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
30dc6087da2b00d1fc3f1a333ba668acff9303a235fa4269fc83400afbf748e6
MD5 hash:
3a9baa3fdff7c4b632c18c29149af180
SHA1 hash:
b80250db474debe4e47f1c673fdb4aaf4ae9bfe7
Detections:
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/65d0b132-c344-4ef3-adb4-ef06182f5614/
Parent samples :
17310a407cf725a962dffd7d620f9bc625331a3b82f4588f882ceffd859ba13e
293fd960e74b47494bc97ded006d308f638e49d5886e664957331a4d1e67ea7e
718d93188640d8dd5261f070a4b0df7575e9c4ecaf2e7b7146305f7a53bab9c6
SH256 hash:
913ae88cfcbad5957ab68de0c030e708ab57304eaecd8898eb4c9176b24d37db
MD5 hash:
77026d6c763afc294ca4df46be7140e4
SHA1 hash:
ae69bad30029b28a40ea1bfe84d0dd7b62551e30
Link:
https://www.unpac.me/results/65d0b132-c344-4ef3-adb4-ef06182f5614/
SH256 hash:
9f75bfb67da98cefeb325bf89be2ebf0b235dabbe8617d9e23e117e03e4cf07e
MD5 hash:
babf1779f37d62b3f1b56622cd680ec2
SHA1 hash:
f340b46cf13975e4a083a621336d3ccf630e66f2
Link:
https://www.unpac.me/results/65d0b132-c344-4ef3-adb4-ef06182f5614/
SH256 hash:
c6048f077a330c5e32d28a4e16bbb702c11d1318d78fbce820f87e6969fc6b27
MD5 hash:
51eeac4c89dad4d409e00735136814e4
SHA1 hash:
f0b60eee1ee396660bd14ca7b390db21c18c633e
Link:
https://www.unpac.me/results/65d0b132-c344-4ef3-adb4-ef06182f5614/
SH256 hash:
693ceec5f16d54fc7a3b9a1554e8fcb8a9e95c177fe7b4709d4277bd79b45d10
MD5 hash:
1b2304e6689e5645647ac59af7d5bc53
SHA1 hash:
d441c4dde03cf0a57cd377cc5890617ac6540a1e
Link:
https://www.unpac.me/results/65d0b132-c344-4ef3-adb4-ef06182f5614/
SH256 hash:
ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747
MD5 hash:
89ac57478044c57c7195943116a521e0
SHA1 hash:
1ff2bafeed795423e3538d810bda8e1e3fcdcfa5
Link:
https://www.unpac.me/results/65d0b132-c344-4ef3-adb4-ef06182f5614/
SH256 hash:
293fd960e74b47494bc97ded006d308f638e49d5886e664957331a4d1e67ea7e
MD5 hash:
153a9b72f0a5b0dc08fda0e8b1ae4a31
SHA1 hash:
16a64d853f53da12f91c4d7636c1f05d2e48ad69
Link:
https://www.unpac.me/results/65d0b132-c344-4ef3-adb4-ef06182f5614/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/293fd960e74b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/293fd960e74b47494bc97ded006d308f638e49d5886e664957331a4d1e67ea7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/353944/

Comments