MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40616665c8e28905ea7bf8726ba31150b48038f68681de80681f6b644d3e0189. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40616665c8e28905ea7bf8726ba31150b48038f68681de80681f6b644d3e0189
SHA3-384 hash: 7f4c75dc6044bdc667ddc940c5bc768ba7fe38e9b5688b383858aac3b884e73bb49d25c98e0a4e527f3a97ed7a15b8d6
SHA1 hash: 3baf54f75aeb8c0de510d63a074c01cf5baa3efa
MD5 hash: 34083975e995381a40fd7e6a1a605052
humanhash: mars-montana-oklahoma-march
File name:40616665c8e28905ea7bf8726ba31150b48038f68681de80681f6b644d3e0189
Download: download sample
Signature Formbook
Create hunting rule
File size:602'624 bytes
First seen:2022-11-08 14:26:50 UTC
Last seen:2022-11-08 16:45:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Xt5P8xJ66h7rosOKD+xhsTwOCf5OtozcJNHfe0yEjI6:X/SJFiw+js8OptozwHG0HE
Threatray 17'209 similar samples on MalwareBazaar
TLSH T17DD42227F7A3F96BC6462736D428480053B9CB4661A3DF2E319523AD0C5736F4E16BC9
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 44c0a8b4a2ea7298 (9 x Formbook, 8 x SnakeKeylogger, 2 x AgentTesla)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
40616665c8e28905ea7bf8726ba31150b48038f68681de80681f6b644d3e0189
Verdict:
Malicious activity
Analysis date:
2022-11-08 14:26:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/572c305b-cadc-40b3-b1c8-5524d5875ae9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/330585/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.63165129.14231.21885.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/636a673738db7c2a0385f0f5/reports/4ed2f338-71e3-4503-9c9c-16eea72067f5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/01470642-5a6f-4c50-9d39-ceb4ce83e48b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1108705
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40616665c8e28905ea7bf8726ba31150b48038f68681de80681f6b644d3e0189/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-10-27 10:13:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibqwmzoi4keql2t37bzgxiyrkc2iaohwq2a55adid5vwitj6ageq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
35511df3a80e96c275e6d63f58921358bf51dbef3f981a316d2212242112ba9f
Formbook
46cbbf73c50dd90268f30bec98085b53402a7de7d0911f4045fb286162687e60
Formbook
9e6253eadc5d2960862d03ba5e28577fc6132497bd86f359557be8b8c22c1210
Formbook
cea0844bf755c190793ac29a2cd95220862993a84c5924faeddce381fcdf063c
Formbook
d936dbd1677939645b8945767ce9525ad92f068e0d81c9316e4c83fe916811cc
Formbook
e13e08e3de1d9fa5a1fee56048118bf59a11ebbadbe2b38af4f10fecb6d29796
Formbook
e8db90d8d2528f0767e5b82262223e07578e29f8e4166df3cf495318006ebbd6
Formbook
fb31038cbb2b0d3e01fb7f461a30ff7210a6f2062bd7d373afe739a701714108
Formbook
+ 17'199 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:pf20 rat spyware stealer trojan
Link:
https://tria.ge/reports/221108-rsfcpabha9/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook payload
Formbook
Unpacked files
SH256 hash:
f38b041ae11863ab3146102075a85714bfd0a3a174eafd52ae12bf72230afd77
MD5 hash:
45954f99b4c66ac25ad840aec7f9dc49
SHA1 hash:
72d25564d93588cf1958728885d2bbcdcad8837f
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/dbc07c17-4dd6-4115-bcac-22bc36316bb1/
Parent samples :
438b38456b5033c20fef9d9da2a1882779b592fba20468242314a14c01c3d27d
4e987a8c97b129afe9669bafd9539a77406580545914336b1e37dacbea5bd738
69c32e09bd27aaea6ed0b0b448e6332f18e67daa0ad5d7cbc74718f9b1236cf5
40616665c8e28905ea7bf8726ba31150b48038f68681de80681f6b644d3e0189
2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded
SH256 hash:
924971edd391379fbed851351b25e82db6b98027b25df3d1d060989fb34d0e95
MD5 hash:
1549de5ccfc4e742e92c951bafc0caeb
SHA1 hash:
e5b8e4e35a0bdedef012b3e3be35f6237c0b95c5
Link:
https://www.unpac.me/results/dbc07c17-4dd6-4115-bcac-22bc36316bb1/
SH256 hash:
bc444c4ec803b91da7af06cb0eb233fe69f565067f89544bf750fc17a9ede6dd
MD5 hash:
b52058082749f08bbcb7036b0d4189e8
SHA1 hash:
90365baf6b18ff3139da00cd5caf30660643110e
Link:
https://www.unpac.me/results/dbc07c17-4dd6-4115-bcac-22bc36316bb1/
SH256 hash:
248a7c4997aacb14ca032daf9668636839f921d0a3403f09a3b0ccfdc948cbf1
MD5 hash:
a7952169b04a2c6a39661aad59e79dcf
SHA1 hash:
88722f1a32c913307c0c6385b04478a79fabd12b
Link:
https://www.unpac.me/results/dbc07c17-4dd6-4115-bcac-22bc36316bb1/
SH256 hash:
d4aad621ea6613314f53eab337a98ff01bc0e4a133afd69b2e28a7cc222b0730
MD5 hash:
0aea6d259f29754bbbb72b84efb6a2f1
SHA1 hash:
84208edfd292fa2042302eaeff23b848e87d6568
Link:
https://www.unpac.me/results/dbc07c17-4dd6-4115-bcac-22bc36316bb1/
SH256 hash:
402f35d404733d99c27d2514a4929b5e4de211a2a6021658100f994d8825989e
MD5 hash:
47f8be0b40340b5f2e58646ea39f3e19
SHA1 hash:
5ec7bd10f4a627149b07bafe7fe5f1c416523938
Link:
https://www.unpac.me/results/dbc07c17-4dd6-4115-bcac-22bc36316bb1/
SH256 hash:
40616665c8e28905ea7bf8726ba31150b48038f68681de80681f6b644d3e0189
MD5 hash:
34083975e995381a40fd7e6a1a605052
SHA1 hash:
3baf54f75aeb8c0de510d63a074c01cf5baa3efa
Link:
https://www.unpac.me/results/dbc07c17-4dd6-4115-bcac-22bc36316bb1/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/40616665c8e2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/330585/

Comments