MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 373834225a126abde8256049e073b8e07bd06c7563f929783f441a1a63a88d1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 373834225a126abde8256049e073b8e07bd06c7563f929783f441a1a63a88d1b
SHA3-384 hash: 267cbd72afb157462c22a6c626c82509821c93ed771c8e810042a8410da80156cc2015ec39ba85d3b8983b1c7d349707
SHA1 hash: b426d39e6928556a2b58d9147c3254b8fa6009a4
MD5 hash: f1878e41af327064496e57f50d35395d
humanhash: massachusetts-dakota-lima-chicken
File name:Image_Of_Victim.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'989'573 bytes
First seen:2022-10-10 05:26:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:C5IoVKMQfTCFbMmHI6jduMG+XtbNztOsrStQ0pDWa:C5IoAMQfIr++dpztpStFJ
Threatray 4'840 similar samples on MalwareBazaar
TLSH T15E95011EF352DCF1F97617B5343559227F39A42259FC5CEE6388022A4F2224212B7E9B
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon eaf42b27070b33c0 (1 x Formbook)
Reporter 0xToxin
Tags:AsyncRAT exe FormBook liteshare Stealerium


Avatar
0xToxin
https://one.liteshare.co/download.php?id=EP4B4O8

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318127/
Detection(s):
SecuriteInfo.com.Variant.Graftor.709227.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Launching a process
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Launching a service
Changing a file
Delayed writing of the file
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Unauthorized injection to a recently created process
Launching a tool to kill processes
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42137/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/6343ad267a6f3f03619d96e3/reports/a7da7ce8-b117-4d3d-8ec0-685ef18f5957/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealerium Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c86399fa-98bd-4544-b60d-dabb65f7fc58
Result
Threat name:
AsyncRAT, DcRat, Stealerium
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1086682
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Capture Wi-Fi password
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal WLAN passwords
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Yara detected AsyncRAT
Yara detected Costura Assembly Loader
Yara detected DcRat
Yara detected Generic Downloader
Yara detected Stealerium
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 719240 Sample: Image_Of_Victim.exe Startdate: 10/10/2022 Architecture: WINDOWS Score: 100 57 Snort IDS alert for network traffic 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 Sigma detected: Capture Wi-Fi password 2->61 63 12 other signatures 2->63 8 Image_Of_Victim.exe 5 2->8         started        11 msiexec.exe 2->11         started        process3 file4 39 C:\nonono.exe, PE32 8->39 dropped 41 C:\Client.exe, PE32 8->41 dropped 13 nonono.exe 15 161 8->13         started        18 Client.exe 3 2 8->18         started        process5 dnsIp6 49 56.14.11.0.in-addr.arpa 13->49 51 ip-api.com 208.95.112.1, 49701, 80 TUT-ASUS United States 13->51 55 7 other IPs or domains 13->55 43 C:\Users\user\AppData\...\LHEPQPGEWF.png, ASCII 13->43 dropped 45 C:\Users\user\AppData\...\IZMFBFKMEB.png, ASCII 13->45 dropped 47 C:\Users\user\AppData\...\AQRFEVRTGL.docx, ASCII 13->47 dropped 69 Multi AV Scanner detection for dropped file 13->69 71 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->71 73 May check the online IP address of the machine 13->73 79 5 other signatures 13->79 20 cmd.exe 1 13->20         started        23 cmd.exe 13->23         started        53 tienMonkey-40774.portmap.io 193.161.193.99, 40774, 49703, 49710 BITREE-ASRU Russian Federation 18->53 75 Antivirus detection for dropped file 18->75 77 Machine Learning detection for dropped file 18->77 file7 signatures8 process9 signatures10 65 Uses netsh to modify the Windows network and firewall settings 20->65 67 Tries to harvest and steal WLAN passwords 20->67 25 conhost.exe 20->25         started        27 chcp.com 1 20->27         started        29 netsh.exe 20->29         started        31 findstr.exe 20->31         started        33 conhost.exe 23->33         started        35 chcp.com 23->35         started        37 netsh.exe 23->37         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/373834225a126abde8256049e073b8e07bd06c7563f929783f441a1a63a88d1b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-10 05:27:13 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g44diis2cjvl32bfmbe6a45y4b55a3dvmp4ss6b7iqnbuy5irunq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
1166e3200fd3a2a7e448f8129fbebdd7266a85393e8d6596ee6f89653adba1d0
Formbook
42726a2132dea4cd8406a0face18551317f74eac29f8e0f8aec8a15fd26cd635
Formbook
6acd5eb47c8c0bd86c1f04947074656f1e77a48dc4f5d2b02b487b4942dfe6c9
Formbook
870a4cfc58c388361c8834701aa8112a0de4155305e92aedc66e0384813d3439
Formbook
b46a6ed5d0d601aa0e1087095ddea928405c927d65ab795aca3a148d2fb37d13
Formbook
ba2c8fcdef3c1675e57b94c9a7b04088a68d98110cf1ddf509eae437f731b138
Formbook
d0fef87fd7e5a7214773deef4c445970147c88d5335867b552f9d4d22ef0231b
Formbook
+ 4'830 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:venom clients collection rat spyware stealer
Link:
https://tria.ge/reports/221010-f5efdaahej/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Checks computer location settings
Reads user/profile data of web browsers
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
tienMonkey-40774.portmap.io:40774
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/321251e0-c3d1-4df5-a508-94039aa64590
Unpacked files
SH256 hash:
ee35138935fff5746463fd908f4490a059777e894206a23bc75c80dcdfbea4b3
MD5 hash:
98b5c23b703f0d796cc1bd440dda3f1d
SHA1 hash:
c28c9488868f4dd18087b228614d040a41498f81
Link:
https://www.unpac.me/results/7ddbdcc1-c54a-4dba-a289-c02d877c7196/
SH256 hash:
8c4328d01f79986294ffd8cfada58d674c67115ebc4b8cd15eec42de7322a450
MD5 hash:
5ed5de6b3c432d4d141bbf64cedce191
SHA1 hash:
33d733fee5c81b0e5d51dc93d2a3f720a52836ec
Detections:
VenomRat
Create hunting rule
Link:
https://www.unpac.me/results/7ddbdcc1-c54a-4dba-a289-c02d877c7196/
SH256 hash:
373834225a126abde8256049e073b8e07bd06c7563f929783f441a1a63a88d1b
MD5 hash:
f1878e41af327064496e57f50d35395d
SHA1 hash:
b426d39e6928556a2b58d9147c3254b8fa6009a4
Link:
https://www.unpac.me/results/7ddbdcc1-c54a-4dba-a289-c02d877c7196/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/373834225a12/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/373834225a126abde8256049e073b8e07bd06c7563f929783f441a1a63a88d1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.
Rule name:sfx_pdb_winrar_restrict
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/318127/

Comments