MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 15

Intelligence 15 IOCs YARA 21 File information Comments

SHA256 hash:	3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38
SHA3-384 hash:	c7242c03c37cf657971b1c811ca5a6b0e00c539af0ba177ae3564cf4cddcac02cb7f5de375a3a4525faa5eddc5a1e04f
SHA1 hash:	5fbc52d53468cff1283232c94fbc779966e22144
MD5 hash:	53532a3ce7ecdd7d9f683119e97ca071
humanhash:	single-lake-echo-nine
File name:	SecuriteInfo.com.Win32.PWSX-gen.26085.6151
Download:	download sample
Signature	Formbook Create hunting rule
File size:	684'544 bytes
First seen:	2023-12-13 12:32:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:dEfLInGy+YYUBYzmjEZ2Yd30MLPnjSg97IQaQRjRcfvrUZWfgZRVHZS0C:M5YnCzOEMYd3RL/mJQaQRVcfgsfgZV
Threatray	9 similar samples on MalwareBazaar
TLSH	T190E4238876A5C3A3C1F63BB91C22C17653B4D2624546E71D2C43A4E85CF7B881AB1FDB
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	cc0f3355332b17cc (12 x AgentTesla, 6 x Formbook)
Reporter	SecuriteInfoCom
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

287

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

Payment_Advice.img

Verdict:

Malicious activity

Analysis date:

2023-12-14 08:06:57 UTC

Tags:

formbook xloader stealer spyware

Link:

https://app.any.run/tasks/a49a4c51-ce19-4a93-b1fe-86a53f0c3314

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/467168/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.26085.6151.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Сreating synchronization primitives

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/6579a486eba10803148a6cc1/reports/047a38db-9a22-4472-a655-8bf14c156f72/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c45d3b79-7ac2-4491-902d-b32e0eed6921

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1361363

Signature

.NET source code contains potential unpacker

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-12-13 12:33:06 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 23 (73.91%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gzuxmmyv7bfxukimgxnmf3peotrpm2iv6dj53l5zah236odebu4a._file

Verdict:

malicious

Label(s):

formbook

Formbook

395394609e2c14a1a56d03db7fae3306a1a57889e89b119e44d207d6d172e21d

Formbook

70bb422c14c0a6b025b134c2f1a49c3e6c1ba206ab844f314a76dfeb308669f1

Formbook

e6dae7830360bb68c07346c6d4d1a34fbad395f816f555ebac96c683adf12008

Formbook

f00b5fbe46481ef64e67801d8c03ac4166ab7758fb5faea3d66987f9e09c4aea

Formbook

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/231213-pq62hseba9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Unpacked files

SH256 hash:

61a7c8e10df3f223cddf30603c4d72c3a5b98e37a675780db0756bcd398c0a95

MD5 hash:

d45fdbe9a98b2fc9ea7f558668c66903

SHA1 hash:

d81b81ff71b5319a157e7ce58a3a9a4ffab31cd8

Detections:

win_formbook_w0

win_formbook_g0

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

d83126391af36918bcaba217b6bb30e991c76c48893410da8f81028e3c8871e8

MD5 hash:

0d1cff892ab669b28d32e010e522aac0

SHA1 hash:

7a6770b6b4d201236b0aa99ad7b57b4e67c73075

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5

MD5 hash:

579197d4f760148a9482d1ebde113259

SHA1 hash:

cf6924eb360c7e5a117323bebcb6ee02d2aec86d

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

069fef43dc8bef92e3ac18e5350e411877033c611be88bf9aa1c2034dd664603

MD5 hash:

2881f197e2b49ad8c2429d428ddb8ab2

SHA1 hash:

8d784dad83a2ff5aa5f30f219bd7b92c99f8ba88

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

Parent samples :

9f58500972fe9038c23e03bbf762494b356e358aebd9125a0a55d9f9ffe042af
4708153c6d03a1d3c32475f529229073defc77516416b5d7b808a9fa345b74e1
f00b5fbe46481ef64e67801d8c03ac4166ab7758fb5faea3d66987f9e09c4aea
9d833b4a66beca22dcee2a030ffa0ff1a9c72eba3f9ee50eb412f56806915f87
3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38
eaabbf2674a70aa254e89b831eb0caa7599e6fc3747e3380cea1ae5b4952d7db
70bb422c14c0a6b025b134c2f1a49c3e6c1ba206ab844f314a76dfeb308669f1
48640541d98ded5a850e2c281cd551eea3598502ab725bfa2ac4ce5f7846b3ed
9a1138a162bb083659fe3716b97ed51486af388c69929decf4db49577c826bd2
add05b10b13891172810c8f90bf624f892ad69fed993944491736cc283a31b01
7314bbdbc2d9f2a842b72db29af17e6e85ca93465a9d4ca53706c671eb86f68f
a581cd3affde45fe840caaee68d4896414839a2e863b00e248888bef5f7270dd
d97147a27a5e87a356dc86aa78f6f764805c16454453014d4b68d510487147d4
fcf48a9792abfda9d9c9d32c6e7348e4cf3fed606c4aea8acf4e2ba4fdf08caf

SH256 hash:

7174f14518c55b29f8f6a7c9d1fa9dc33aaae5a25fdfa70a0597b3b7b43d89fa

MD5 hash:

612fbf91dac86bdaa0b568e640008c61

SHA1 hash:

54076ee81a651b1d580e73f8ad9e04707c2c922b

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

0987eb466e71500d3ad171f5850c9808be6b7546eac5a65941a2f651d68ad2d6

MD5 hash:

ce3a039d4c31b13d9ba779ea96ba8b0c

SHA1 hash:

c1033cd2cea37cf23846c1dca86dc187a01052f5

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

a458badbf3b51fc42fab888213647b1710f25e0af40ddf67c2c7032cda53014f

MD5 hash:

f1a33993918141ceeade436d1a4a87ba

SHA1 hash:

8b966cc6846f74e90863e7dcbd774e65a6454234

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

73e48f9be8ff0fd81f5412b1b6a3360cce11144e71cc3ad5a424a0780d441cd6

MD5 hash:

7799a992df8ec4fba51593bf7a297e85

SHA1 hash:

847b2266ce64d5a2f0e869cd20b6d069956c13f8

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

89d36fcf93146b08fcdce899ad4cac257fba7b89ba5a0a503a1f2a0845982218

MD5 hash:

950fe930dc11be1d723ac279c91eabef

SHA1 hash:

3c4e0eafd3f87949c317d81525e9c8b06a0391a6

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

86031896e3e697342fbe0e2afab2e42eee4ac1782a4c01162962e7da190cbe8d

MD5 hash:

dc2a59fb19e5e8d1708a854c83ef7ecb

SHA1 hash:

1b1c6ec1156271ec36f1fe36ebf9f7304695bee8

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

SH256 hash:

3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38

MD5 hash:

53532a3ce7ecdd7d9f683119e97ca071

SHA1 hash:

5fbc52d53468cff1283232c94fbc779966e22144

Link:

https://www.unpac.me/results/764dd7af-f2bf-4dfd-b843-35c46c915808/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_Formbook Create hunting rule
Author:	@malgamy12

Rule name:	Windows_Trojan_Formbook_1112e116 Create hunting rule
Author:	Elastic Security

Rule name:	win_formbook_w0 Create hunting rule
Author:	@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/467168/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample