MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47796a46d5c191e29988d2d657332b3d7f9f5278b3951049e98f80a2b0c11d5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47796a46d5c191e29988d2d657332b3d7f9f5278b3951049e98f80a2b0c11d5e
SHA3-384 hash: c47c6d454ae3fdd55a50e83fc7a2c9abcd2567ebb122aec0aeabc9e325983317582a2894e835456c3012864cd585f0dd
SHA1 hash: 57358b44fb87f5250b344d64ab7c0bd0e1c32085
MD5 hash: 046c329d76fe2ee315e5dad070d7fd6c
humanhash: lake-island-quebec-lamp
File name:skyrun46657.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'827'840 bytes
First seen:2022-08-05 14:53:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:XbOPspe2qq3n8Pk3LtLSGd0yhvQYz/IcmwwdzjoNrhLFN7A941nC+YUilZQedRVW:Xb02bxNHrs9wCWilSE
TLSH T137858D710C19E943A1FEAA9F8E193558131FE09E1CCF4BEAA25929F77D3A947F1241C0
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
415
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
skyrun46657.exe
Verdict:
Malicious activity
Analysis date:
2022-08-05 14:56:05 UTC
Tags:
formbook trojan stealer
Link:
https://app.any.run/tasks/44998c6c-86a4-448b-b82b-6555599aa2e8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/296734/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.AgentTesla.MY.MTB.25622.28556.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a file
Searching for synchronization primitives
Сreating synchronization primitives
Launching cmd.exe command interpreter
Reading critical registry keys
Setting browser functions hooks
Unauthorized injection to a browser process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62ed2f86b7eec656278e1554/reports/192dde5a-2246-4cfe-9982-342ed09f2f75/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8402142a-a04d-4284-80b8-314cd29919c8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1046882
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/47796a46d5c191e29988d2d657332b3d7f9f5278b3951049e98f80a2b0c11d5e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-08-05 11:29:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
20 of 40 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i54wurwvygi6fgmi2llfomzlhv7z6utywokraspjr6akfmgbdvpa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:sn31 rat spyware stealer trojan
Link:
https://tria.ge/reports/220805-r9vtpseag8/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook payload
Formbook
Unpacked files
SH256 hash:
df5bce8b300e3ac7dadb69d68a0bc190e5ae29028a94f2095e897543965d867d
MD5 hash:
208388b33a58f5dda08110144db83433
SHA1 hash:
a768cb5e1e2af42570c3d9c4feada82ec8c15e54
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/c0e467da-f102-4f7f-ab7e-fcb974b80183/
SH256 hash:
b02dc5b7e58275ad45eb4df02325f5fca9204fa17b52d33bdbc50ffdc6d46e3c
MD5 hash:
6172516b2cf7a0ce0ee0e31f64161e13
SHA1 hash:
877e795a74b2bc6ceffcd6b141e0acc97beb21d7
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
FormBook
Create hunting rule
Link:
https://www.unpac.me/results/c0e467da-f102-4f7f-ab7e-fcb974b80183/
Parent samples :
dc44140377b017e013ca665c49ebacd386d4a4ca19329e77d9dfbb86010e66a5
2537720d5a68fae9bd2bd01925102deb25af75b86fbdc295f166efc97e636cfe
77c54b077789c0f6523b29fec23823227ffeca21d82c627e63f92d95b59e1905
35edcaa0f180ef140f70ee241a648c6335cf3055dcf2d6074d5ef7966b55925d
47796a46d5c191e29988d2d657332b3d7f9f5278b3951049e98f80a2b0c11d5e
SH256 hash:
dc88613cee5ca4e89b26896ee58903a590f7ed64b1be9468d8b3542839156991
MD5 hash:
1a194e1930dffc4528786d5076cfa809
SHA1 hash:
e5358c193dacb48d7a474f3d1836236fd0a5dc36
Link:
https://www.unpac.me/results/c0e467da-f102-4f7f-ab7e-fcb974b80183/
SH256 hash:
47796a46d5c191e29988d2d657332b3d7f9f5278b3951049e98f80a2b0c11d5e
MD5 hash:
046c329d76fe2ee315e5dad070d7fd6c
SHA1 hash:
57358b44fb87f5250b344d64ab7c0bd0e1c32085
Link:
https://www.unpac.me/results/c0e467da-f102-4f7f-ab7e-fcb974b80183/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/47796a46d5c1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/47796a46d5c191e29988d2d657332b3d7f9f5278b3951049e98f80a2b0c11d5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:malware_Formbook_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 47796a46d5c191e29988d2d657332b3d7f9f5278b3951049e98f80a2b0c11d5e

(this sample)

  
Dropped by
formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/296734/

Comments