MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
SHA3-384 hash: 65235d32734b8be88243da3601ffedfd31cd39363b03834ba354823b4159e9f1df9a1dbc495f82a3ed61d5b4413fb077
SHA1 hash: 629f14639425f40e3ad081e4fcb0b4238e4f40d1
MD5 hash: d1cd47f7c1b362dd9f478ad795596180
humanhash: friend-snake-helium-florida
File name:325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
Download: download sample
Signature Formbook
Create hunting rule
File size:872'960 bytes
First seen:2023-07-05 13:34:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:Fo/thewlqB6p9+KJHHxQcRy93RvsB3VuCXdY:6e2q8p93Qb93R03n
Threatray 3'252 similar samples on MalwareBazaar
TLSH T10805122826FB0A29C4573FBC0C1185B5C7EDA8517833C24B4FA3BCE9CE26B584D95697
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0d4d4c4c4c4c4f0 (13 x AgentTesla, 10 x Formbook, 4 x Loki)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
Verdict:
No threats detected
Analysis date:
2023-07-05 13:37:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d4c4d076-a36d-4474-af7b-68d48e31832a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/407744/
Detection(s):
Win.Packed.LokiBot-10003974-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64a571876e7b18c9f43c9a5a/reports/41845a76-21c0-4d58-8b1f-1d0cf2f34c43/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9f489646-d4ab-4ed4-9cd9-22177f8c6cca
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1267445
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2023-06-06 08:00:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gjnpenuwsgsf6vbb2fa2rnhh2wq2dpbixtqvttgeehnkxlwii37a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
19b7214fa574ae296ae0494841dbd55d213c422c8872867e1be8969bb6d0e812
Formbook
2df55ec2cbfe5ba2ddfd9a597a1c2dcfe3c91f211ba611180c97443773f79732
Formbook
34a8585e0643993caaaa6c3fcd9933354087422062d3c887dada1d65b570bfb3
Formbook
392a3c13cc6f2803845bf0dc6bba16c5d56d0ee46aaaedab6c4de842cce50429
Formbook
420755b65fa49bff0785ce8a56600f1e813f7821fef09f156cfebfb46f8f1096
Formbook
607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7
Formbook
6c5b4378745340c16dea4416b667471193eb51246b48c0a2e69b7c22ec94c3c0
Formbook
b1d6939bbb4a9f66306d13bd4b0cd7a59fbe69c451c3bd2df836a65c1114f70a
Formbook
e40bff3bb093b2bdc11d7e1d5a990db99b3a914dc74a1aec2d28662da10cde9b
Formbook
+ 3'242 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230705-qvnleacf78/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
b5582e73e588fc959cae146c63acd70c9051dd96f3ff5113f643766f848f8e94
MD5 hash:
c9b3905a3a1f68967d555842586865f5
SHA1 hash:
c9b61046eb966be617cef654ebd6cf7a6b585bf5
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
Parent samples :
6c5b4378745340c16dea4416b667471193eb51246b48c0a2e69b7c22ec94c3c0
420755b65fa49bff0785ce8a56600f1e813f7821fef09f156cfebfb46f8f1096
325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
2ba0e2aa5120cd3969463699261f1ffc71763fa001212564375d578e7301523f
SH256 hash:
57b7c6678d14d1f241d11540546d0f726b19fe65e71168b325e8b7146daf3dc5
MD5 hash:
104b4b88600bdd650c4e3f8903d9d292
SHA1 hash:
d50033a865b5e43e8e2b69a06fec4761375f2c95
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
9f7388193b340da1e3c40072a9e00f64ac7379cd90ff1f1a1581ef32393d6973
MD5 hash:
8ea629ab6f57f45f9b646a9d92e95af5
SHA1 hash:
6ce089d96d5b8d222d41b5e5765179474c6cadf0
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
a166713fad259213d4e6fcb96721757caccd2dee7007a2a81197bec2f5208dca
MD5 hash:
de2f3c29a86aac0af142ee6cc1195414
SHA1 hash:
35fb9dddfb2db2b7f99bec2e536857bd719a208c
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
b5582e73e588fc959cae146c63acd70c9051dd96f3ff5113f643766f848f8e94
MD5 hash:
c9b3905a3a1f68967d555842586865f5
SHA1 hash:
c9b61046eb966be617cef654ebd6cf7a6b585bf5
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
Parent samples :
6c5b4378745340c16dea4416b667471193eb51246b48c0a2e69b7c22ec94c3c0
420755b65fa49bff0785ce8a56600f1e813f7821fef09f156cfebfb46f8f1096
325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
2ba0e2aa5120cd3969463699261f1ffc71763fa001212564375d578e7301523f
SH256 hash:
d29df9671560a7ca8ad7dd7cfd05c8adee9436ef9c30a1ed77f86ce9b1b59653
MD5 hash:
845134f32bf1dbf96cb2a8cc9a2170c5
SHA1 hash:
0e1a9f487c96451e5b11e279eddcdf6576adafd3
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
57b7c6678d14d1f241d11540546d0f726b19fe65e71168b325e8b7146daf3dc5
MD5 hash:
104b4b88600bdd650c4e3f8903d9d292
SHA1 hash:
d50033a865b5e43e8e2b69a06fec4761375f2c95
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
9f7388193b340da1e3c40072a9e00f64ac7379cd90ff1f1a1581ef32393d6973
MD5 hash:
8ea629ab6f57f45f9b646a9d92e95af5
SHA1 hash:
6ce089d96d5b8d222d41b5e5765179474c6cadf0
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
a166713fad259213d4e6fcb96721757caccd2dee7007a2a81197bec2f5208dca
MD5 hash:
de2f3c29a86aac0af142ee6cc1195414
SHA1 hash:
35fb9dddfb2db2b7f99bec2e536857bd719a208c
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
d29df9671560a7ca8ad7dd7cfd05c8adee9436ef9c30a1ed77f86ce9b1b59653
MD5 hash:
845134f32bf1dbf96cb2a8cc9a2170c5
SHA1 hash:
0e1a9f487c96451e5b11e279eddcdf6576adafd3
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
b5582e73e588fc959cae146c63acd70c9051dd96f3ff5113f643766f848f8e94
MD5 hash:
c9b3905a3a1f68967d555842586865f5
SHA1 hash:
c9b61046eb966be617cef654ebd6cf7a6b585bf5
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
Parent samples :
6c5b4378745340c16dea4416b667471193eb51246b48c0a2e69b7c22ec94c3c0
420755b65fa49bff0785ce8a56600f1e813f7821fef09f156cfebfb46f8f1096
325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
2ba0e2aa5120cd3969463699261f1ffc71763fa001212564375d578e7301523f
SH256 hash:
57b7c6678d14d1f241d11540546d0f726b19fe65e71168b325e8b7146daf3dc5
MD5 hash:
104b4b88600bdd650c4e3f8903d9d292
SHA1 hash:
d50033a865b5e43e8e2b69a06fec4761375f2c95
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
b5582e73e588fc959cae146c63acd70c9051dd96f3ff5113f643766f848f8e94
MD5 hash:
c9b3905a3a1f68967d555842586865f5
SHA1 hash:
c9b61046eb966be617cef654ebd6cf7a6b585bf5
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
Parent samples :
6c5b4378745340c16dea4416b667471193eb51246b48c0a2e69b7c22ec94c3c0
420755b65fa49bff0785ce8a56600f1e813f7821fef09f156cfebfb46f8f1096
325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
2ba0e2aa5120cd3969463699261f1ffc71763fa001212564375d578e7301523f
SH256 hash:
9f7388193b340da1e3c40072a9e00f64ac7379cd90ff1f1a1581ef32393d6973
MD5 hash:
8ea629ab6f57f45f9b646a9d92e95af5
SHA1 hash:
6ce089d96d5b8d222d41b5e5765179474c6cadf0
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
57b7c6678d14d1f241d11540546d0f726b19fe65e71168b325e8b7146daf3dc5
MD5 hash:
104b4b88600bdd650c4e3f8903d9d292
SHA1 hash:
d50033a865b5e43e8e2b69a06fec4761375f2c95
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
a166713fad259213d4e6fcb96721757caccd2dee7007a2a81197bec2f5208dca
MD5 hash:
de2f3c29a86aac0af142ee6cc1195414
SHA1 hash:
35fb9dddfb2db2b7f99bec2e536857bd719a208c
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
d29df9671560a7ca8ad7dd7cfd05c8adee9436ef9c30a1ed77f86ce9b1b59653
MD5 hash:
845134f32bf1dbf96cb2a8cc9a2170c5
SHA1 hash:
0e1a9f487c96451e5b11e279eddcdf6576adafd3
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
9f7388193b340da1e3c40072a9e00f64ac7379cd90ff1f1a1581ef32393d6973
MD5 hash:
8ea629ab6f57f45f9b646a9d92e95af5
SHA1 hash:
6ce089d96d5b8d222d41b5e5765179474c6cadf0
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
a166713fad259213d4e6fcb96721757caccd2dee7007a2a81197bec2f5208dca
MD5 hash:
de2f3c29a86aac0af142ee6cc1195414
SHA1 hash:
35fb9dddfb2db2b7f99bec2e536857bd719a208c
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
d29df9671560a7ca8ad7dd7cfd05c8adee9436ef9c30a1ed77f86ce9b1b59653
MD5 hash:
845134f32bf1dbf96cb2a8cc9a2170c5
SHA1 hash:
0e1a9f487c96451e5b11e279eddcdf6576adafd3
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
SH256 hash:
325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
MD5 hash:
d1cd47f7c1b362dd9f478ad795596180
SHA1 hash:
629f14639425f40e3ad081e4fcb0b4238e4f40d1
Link:
https://www.unpac.me/results/0eae6ed7-95e7-4a42-8b9d-13904cce19e5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/407744/

Comments