MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 37b917980a25374058247c7dc8f63393dcca983fc522bef8d2be422206d9b865. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | 37b917980a25374058247c7dc8f63393dcca983fc522bef8d2be422206d9b865 |
|---|---|
| SHA3-384 hash: | ca716458d82df0f9cc7143c81cda1d723951265b7d9c7a3fa83d24925cfbd23a28130b473ad3bee47d33d8bde12e7de8 |
| SHA1 hash: | 2a891a2ce8fe1c5a3139f0841c1b15e4bcd6d8a5 |
| MD5 hash: | ccbe9aabcefa40af1e346e51ccee2b06 |
| humanhash: | happy-twenty-bacon-autumn |
| File name: | SecuriteInfo.com.Scr.Malcodegdn34.22849.2134 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 669'696 bytes |
| First seen: | 2022-04-25 05:30:02 UTC |
| Last seen: | 2022-04-25 08:11:27 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:mpMvTZJXjVmP6FD6GToNd15FePXpy/IM1n5dYfJidpihdBWeKzaUOx/ZqBUfgfzC:mpMLBdDKbyZqCSWuh |
| Threatray | 16'070 similar samples on MalwareBazaar |
| TLSH | T14EE4AD577559CA05C8B8BAF652205D9002A1AE8E80B1D2F91CB137B929F77C3FE107DE |
| TrID | 49.6% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 21.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.9% (.SCR) Windows screen saver (13101/52/3) 7.1% (.EXE) Win64 Executable (generic) (10523/12/4) 4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) |
| File icon (PE): |  |
| dhash icon | 0f3375cccc61338f (15 x AgentTesla, 11 x Formbook, 6 x SnakeKeylogger) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
252
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
obfuscated packed replace.exe update.exe
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
xloader
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-04-25 03:09:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
20 of 41 (48.78%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 16'060 additional samples on MalwareBazaar
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:nd04 loader rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
e38623b1395f59052d1bb12d889f9656d875b4718490678efcfa693ef204756b
MD5 hash:
aeb1ffeae0ec51c4d4e0dd96953c39fc
SHA1 hash:
6454046d14776fb6dec231da503ea32033cb8bc6
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
1f5bc7997fbefad47ba836e74a08cface659d9650e9ff5a73a444078014ea382
MD5 hash:
d3215440d6825dd71ef78151c6274581
SHA1 hash:
12894dbfc3005d307ae01669f56829f1ba3cb2a7
SH256 hash:
09cd3bc420c8982190990a9673b58c3ab01e933dff0881f1e521d3316f1b9a6b
MD5 hash:
6933707e111286a128ad0f7fa298153f
SHA1 hash:
d1121c8bed634e9684727e8c0aad3f597b0749ad
SH256 hash:
f663989583e987409d0ba4b5d2ca5b8c55c694f417b936449d23fb8ac5ec6295
MD5 hash:
bb25bbffb50d68f75d90c980714d7983
SHA1 hash:
bf1b2e9de679aa3315ac84ad6a935973ff71ceb7
SH256 hash:
1a3781b73c99b0a6339b6c37b05d7d6196748447af968a34c313afa6a410cb77
MD5 hash:
09184388525ac3a4077238c4f7c44dba
SHA1 hash:
0f7ab74f4c27a96afeea2acb71088aa665e14a22
SH256 hash:
37b917980a25374058247c7dc8f63393dcca983fc522bef8d2be422206d9b865
MD5 hash:
ccbe9aabcefa40af1e346e51ccee2b06
SHA1 hash:
2a891a2ce8fe1c5a3139f0841c1b15e4bcd6d8a5
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pdb2 |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.