MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e744c3094645bf04cea5756fe54d7b04a32a59bed5d945ac4ccc9b06fb85ef5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e744c3094645bf04cea5756fe54d7b04a32a59bed5d945ac4ccc9b06fb85ef5
SHA3-384 hash: 128770ae598a9b482c1b66dd51fe10b8a23cc103bb135280c1bd8ce63f32e297e02eaf7bd77097c14814e1555dab3924
SHA1 hash: 70a5f54a056ceaa70e34ea37efd5f668e0360696
MD5 hash: ea07ec5ed571fe97232b71120ba5e71d
humanhash: july-jig-east-august
File name:SecuriteInfo.com.Trojan.DownloaderNET.252.11132.4408
Download: download sample
Signature Formbook
Create hunting rule
File size:43'008 bytes
First seen:2022-02-09 13:52:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 768:xdnPOgpAgka/8HHUTQQQQQQQBdy3bI91GN6bcE/2ihWSCAtkrjL1FG:zlpga/eHUTQQQQQQQBdBgN6b5/2kWSCK
Threatray 13'167 similar samples on MalwareBazaar
TLSH T144132A42D6A20267D6A947F3B49346C30BA5640D5CF08EAB98C9709F0D9F3157943FDE
File icon (PE):PE icon
dhash icon 550959654d651945 (37 x Formbook, 28 x AgentTesla, 14 x RemcosRAT)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/239562/
Detection(s):
SecuriteInfo.com.Trojan.DownloaderNET.252.11132.4408.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Creating a file
Searching for synchronization primitives
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/6203c745845a69d77351d7a1/reports/585ed586-4d4f-404e-aca1-de6a57841685/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c22c6813-1036-4dfc-a312-10ef4284e3b7
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/936904
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e744c3094645bf04cea5756fe54d7b04a32a59bed5d945ac4ccc9b06fb85ef5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-09 09:33:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hz2eymeumrn7athkk5lp4vgxwbfdfjm35voziwwezte3a35yl32q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
31168981af16e0fc209774a91e04e5aaf622cacbed12e970b7a35db0705174d6
Formbook
34fc8a270fda2856448cb455e3dca4d8210f5e83f25f1fa8339d8f428a449466
Formbook
3d1c26a55a0b7a502b019b18f4b6e87c1273d3c42a50d20c958d510f530c5f40
Formbook
7c7116c6a0f1e06e4c252ea45668b85c1fdf3f35216097be1208e14be4066b36
Formbook
a6e23730cd711af23e7900cbabb871b668d37a74dda0c97d63f3303167861cf5
Formbook
c68187b173ad6e5f68910e7e23137e30c348192f861ef27e45bf82c0bc8663e8
Formbook
e8720afe9895124761086a0f00aa515997015669cc5332aebe99d5ea02ca7377
Formbook
fcccde6b56dbe8650273f1d67957a1adc1dd0e783d43d6543da7a44696731292
Formbook
ff3f7736a06e89ae300270369d83b922423c8a840903b30a8a21365c4b0b0628
Formbook
+ 13'157 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:zqzw loader rat suricata
Link:
https://tria.ge/reports/220209-q6z4ksafdq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
3e744c3094645bf04cea5756fe54d7b04a32a59bed5d945ac4ccc9b06fb85ef5
MD5 hash:
ea07ec5ed571fe97232b71120ba5e71d
SHA1 hash:
70a5f54a056ceaa70e34ea37efd5f668e0360696
Link:
https://www.unpac.me/results/3969026e-60e0-471d-9e60-d03822536a14/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3e744c309464/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/239562/

Comments