MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 44bd5d877ccf6a64815ff6f6224f7286bd4b10bbaa862470e84e61964c8f4290. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 44bd5d877ccf6a64815ff6f6224f7286bd4b10bbaa862470e84e61964c8f4290 |
|---|---|
| SHA3-384 hash: | e9387d2507cbf32d681021d19df869d074a3bf937ddf40a6c25e195f4a9e4ca422f43da05f3b6751cc5c73ab3c274c93 |
| SHA1 hash: | 62cead962adc5acbf611f003559a364bd44a9665 |
| MD5 hash: | be8be5dd7872072f6ca2fc67723226ad |
| humanhash: | north-five-charlie-equal |
| File name: | be8be5dd7872072f6ca2fc67723226ad |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'444'864 bytes |
| First seen: | 2022-03-03 11:23:36 UTC |
| Last seen: | 2022-03-03 13:41:50 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger) |
| ssdeep | 24576:lKWKpodqu3S0BZj1hLTIrJ2linoSXoujt4YqKZD0oqeHIpydM9qLAk:lKXuiGZs0linoSXoujt4YqKZD0teHIpO |
| Threatray | 13'756 similar samples on MalwareBazaar |
| TLSH | T14F65F1C2E14A5403DB7D847DB4935D34676B9E6B183F8212097C9AB81043ABB3F366F9 |
| Reporter |  zbetcheckin |
| Tags: | 32 exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Adding an access-denied ACE
Using the Windows Management Instrumentation requests
Launching a process
Creating a file
Сreating synchronization primitives
Launching cmd.exe command interpreter
Searching for synchronization primitives
Reading critical registry keys
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Yara detected AntiVM3
Yara detected FormBook
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Detection:
formbook
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-03-03 11:24:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
19 of 27 (70.37%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 13'746 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:z584 evasion rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Formbook Payload
Looks for VirtualBox Guest Additions in registry
Formbook
Unpacked files
SH256 hash:
8df37077e19033057b920fa08b580385949cc9a7e08b126ab351ec0c1b091560
MD5 hash:
a0cf6adb5673bf8bb37186d6a9100a62
SHA1 hash:
a8c69b07373bcd38a116b070ac2fd06894f616fb
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
1bcab3bc6b01b3e22691e2f5d0243b9c30b6313b73df6b431e0ba71c9b4261a9
MD5 hash:
02c0ededd7134b2465e1baed08764b03
SHA1 hash:
4d36bc361d564ad377a9a00429410d42d4794263
SH256 hash:
f59ddcc8830d598afff3547f0470f3a8a5da2253f4d7686abd0437f634b9d985
MD5 hash:
4b3916e13a9e5df3bbbcb7cec4a56766
SHA1 hash:
4427e661aa1601aa5a0594ed1ec5b87e79e10548
SH256 hash:
70b785e5cb5b2e61c0f5da4a71ab0bbd14d9a0849387f037e0d75cc1ffe0a082
MD5 hash:
5951b52c9b4d11ca7f4f33e5a3fb2c31
SHA1 hash:
0bc54fd699fff7b93e5c447a141c0d904924ab0d
SH256 hash:
44bd5d877ccf6a64815ff6f6224f7286bd4b10bbaa862470e84e61964c8f4290
MD5 hash:
be8be5dd7872072f6ca2fc67723226ad
SHA1 hash:
62cead962adc5acbf611f003559a364bd44a9665
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://103.153.77.78/savespace/vbc.exe