MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4759019b080ba0e6212bf1db94be7c1efebcb517a7cd7060186f50731c662769. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4759019b080ba0e6212bf1db94be7c1efebcb517a7cd7060186f50731c662769
SHA3-384 hash: 34c33053c5590258495c3779a553974149417180d10d01c3ac3474818dabf8d25f5d5261be6e650147bb6aceeaec39bd
SHA1 hash: 2294f032b10b5b2c153969e4c8d14ade890c93c0
MD5 hash: bd92246cad573bce0b993f045b28aba6
humanhash: september-item-nevada-hydrogen
File name:SecuriteInfo.com.Win32.CrypterX-gen.21967.1078
Download: download sample
Signature Formbook
Create hunting rule
File size:626'688 bytes
First seen:2023-05-15 10:32:21 UTC
Last seen:2023-05-16 12:06:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'598 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:pJysS7oNdDuaeupD1HnFVfYi9/xcUPv3zEWyqBb1rXvvsOB:RDmK7Yi9/xrEWyqBJB
Threatray 2'836 similar samples on MalwareBazaar
TLSH T15AD4F1A9B1F90B63C77943F585A826410B7472A77D27D93C1EDE20C6F946F1019ACAC3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
4
# of downloads :
252
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.CrypterX-gen.21967.1078
Verdict:
Suspicious activity
Analysis date:
2023-05-15 10:36:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b91f8ddb-2fe3-4ed2-a80a-04bf5ec42074

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/390035/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.21967.1078.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
floxif packed threat virus
Link:
https://www.filescan.io/uploads/64620a5e18c2b9a49ad22e00/reports/26bf51bc-c5f2-4804-844d-cbaa2fa2eca6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4759019b080ba0e6212bf1db94be7c1efebcb517a7cd7060186f50731c662769
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/87ef0786-11d1-42c9-afbc-9f606e0b4bb3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1233623
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4759019b080ba0e6212bf1db94be7c1efebcb517a7cd7060186f50731c662769/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-05-15 10:33:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i5mqdgyiboqomijl6hnzjpt4d37lznixu7gxayayn5ihghdge5uq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0003b5d6c92e1466b6f734da9175b9cfc65ebd4d576b73f92100b0b2e899bb3b
Formbook
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
Formbook
2484f3b9e112f39471b0375d98ac190b4ffe3e29a295bcecdb8fd7b71af0094b
Formbook
28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4
Formbook
4d9d3571a9694b594e2be0b578c92ace288b1446aa514b5d0606f2809783e6f5
Formbook
7d0fdf3abd56e00933c0fa8cf573b948a4c9d85248915249f1909e6775f75e75
Formbook
bf7d050627a7bf67ad74bed6cf159d30c88423a1c0ef53f9fdc80b6977e79d9e
Formbook
cc9fd84fffa1811ef3177586d7c6aee88dc4dc5412fd658ee4bb36ff934eec01
Formbook
fc52523013f9198bf95daa7b6f6a597b518273b54c50635784deee1e3c9dd991
Formbook
+ 2'826 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230515-mlhr1sac3y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
e031d5f3652259dd052e79eaee198ab7fb0feb522a859771289a39a73a297f06
MD5 hash:
5e5b621044793588fde2b9482b862083
SHA1 hash:
b85e8343fc412a63748589cd544b90ccc841dc92
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/9ea0828d-9a47-40df-abca-ea22ece6b2d4/
Parent samples :
0003b5d6c92e1466b6f734da9175b9cfc65ebd4d576b73f92100b0b2e899bb3b
19a7140e84227b4d9af59569af23a0a5a1edd34c45b24691348f227f2c540712
4759019b080ba0e6212bf1db94be7c1efebcb517a7cd7060186f50731c662769
a4d87571d194ad479fd34b94ea91c8afb5b0bd448f2032a8868fa5c16adbaa73
e2c2908685e1e75ab146191d8757a42fda84c0c0be27f2fd7fe301a8fc0bb679
1d362a46e002c187e1ad022dea2fa97809a211c9ba763cfe63600d893fa3ab08
83655561bbc25a8d8d3e737bed283be32e228982310731a9640000797cd520b3
8bc2209887fffd6b27980ba8c2c138deb45370c5b0a8434f9542897c6a05c931
ede3876cdaa9f15dc9f49a080713bfc4e254d222d99c2a09b999d62d1d4f8c05
b755e080b9f6705b088275a44a96251bc547ad58b4f63c9988d90e1c97bf283f
36bd2802a452a2bee1659648b0a4b1de0cde1ebac09d0d5ebe0e2c1189483432
6371e6f808e46f98c8d2e98d1a81203dc6ec3aa755ee5e61bee436bcfdb92cbd
a29611641a2f20fafa07843982a24baf1e253bf03439d0905b61e816339158f9
607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7
00446b78e85b721ff8ab19643f451074ed52d3ceb924f059f1b1c778af8fc42f
SH256 hash:
fc83e07cff47a7ea1058bf4d75f6d98fcdaf457a6f88007dccbbc36796a16847
MD5 hash:
fe559bbf47ec0c554420bba97f79ba0e
SHA1 hash:
c097427b5800a352d105c830e98332fe8925bcdc
Link:
https://www.unpac.me/results/9ea0828d-9a47-40df-abca-ea22ece6b2d4/
SH256 hash:
b9f9ba8a90b50cf73b1c6e359dde3dbb94a1a1438237559cc57d9918ddcebf14
MD5 hash:
ad4c8f22060501f1c0965fce08382b64
SHA1 hash:
c0f3af0482ade26413a7031c3cabb052a97c3758
Link:
https://www.unpac.me/results/9ea0828d-9a47-40df-abca-ea22ece6b2d4/
SH256 hash:
8512d1da2ec434e5aa033ee0935825065f896940befa8524c9259c52df2ab7de
MD5 hash:
12fee7f58bdf71fc0f7d0a2e38ccebeb
SHA1 hash:
4b836ff4a6c17c63d5be4f036b70e7941607681a
Link:
https://www.unpac.me/results/9ea0828d-9a47-40df-abca-ea22ece6b2d4/
SH256 hash:
b52c29ba9ef8996bdf721950d900db96f1befb9883eb38c2075528e60c7aabd4
MD5 hash:
7b6143d9d94c8b80d191b77d8b6d1ba2
SHA1 hash:
1c91704ff6da2a9dd8aaa2ff2d5a5f69a445f76b
Link:
https://www.unpac.me/results/9ea0828d-9a47-40df-abca-ea22ece6b2d4/
SH256 hash:
6722a58c81f6d11004e880bd8481acc423bf96afd46bf692f1562cfa4c5852bd
MD5 hash:
d92d2ba953be4be2d6f2bc859ec5c607
SHA1 hash:
05da51752277bd907ebcfb799524ec7655abbc3a
Link:
https://www.unpac.me/results/9ea0828d-9a47-40df-abca-ea22ece6b2d4/
SH256 hash:
4759019b080ba0e6212bf1db94be7c1efebcb517a7cd7060186f50731c662769
MD5 hash:
bd92246cad573bce0b993f045b28aba6
SHA1 hash:
2294f032b10b5b2c153969e4c8d14ade890c93c0
Link:
https://www.unpac.me/results/9ea0828d-9a47-40df-abca-ea22ece6b2d4/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4759019b080b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/390035/

Comments