MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47a1b7e633dbfe5227f021deb30d806d9546e17044bef8dd54fb2cc21096a471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47a1b7e633dbfe5227f021deb30d806d9546e17044bef8dd54fb2cc21096a471
SHA3-384 hash: 631fbe43a13a6b6682afba3591a55469a9eb1a405d1397094fc256087029c750d91e6f60ead53acffe9c0934cedc9476
SHA1 hash: 1058ea7d6bb4f68b92e08ca7806a542afd32e67f
MD5 hash: 5dd5ba675cb35df77e879297c615548a
humanhash: whiskey-lithium-nitrogen-batman
File name:Abyjifi_Vxetragp.dll
Download: download sample
Signature Formbook
Create hunting rule
File size:1'505'792 bytes
First seen:2022-05-08 23:29:43 UTC
Last seen:2022-05-09 00:29:39 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 24576:AYtJuMJP2xMGCoShcsKFzfYXxbtNSUCkTRtR8278EzWqFoF86ihgYmXYxsTsWaQB:FzUj8UWoGhM
Threatray 479 similar samples on MalwareBazaar
TLSH T163653947A6D2BF63C11A0736C2DB580C43A6E5556A13FB0BB9861B2A49C33FE4D4DD0B
TrID 83.7% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
4.6% (.SCR) Windows screen saver (13101/52/3)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter pr0xylife
Tags:dll FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
324
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.Variadic.A.466.1.20498.18007.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm obfuscated packed
Link:
https://www.filescan.io/uploads/6278527ca40dfc4df20fb407/reports/f8eb81f3-e2b8-4039-9d4e-7bb98d2e27bd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Injector
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0d388a2c-b58f-40e5-aa63-3627956aff65
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/989850
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47a1b7e633dbfe5227f021deb30d806d9546e17044bef8dd54fb2cc21096a471/
Threat name:
ByteCode-MSIL.Trojan.Variadic
Create hunting rule
Status:
Malicious
First seen:
2022-05-08 23:30:13 UTC
File Type:
PE (.Net Dll)
Extracted files:
3
AV detection:
12 of 42 (28.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i6q3pzrt3p7fej7qehplgdmanwkunylqis7prxku7mwmeeewuryq._file
Verdict:
malicious
Similar samples:
2a6a175d59e4c5c69eb490f20296a26ea53d59eb6580b3b34dfa1d2c4f717e76
Formbook
41534cbdad51e3ae39a1346396ff9706c1e24a27a8051f2bb4c92148edb741d8
Formbook
48b87eb4ae33650b8eae8e4c3927d6e3e2b5e6f4e4fa7afd6b829992a395ca79
Formbook
6af08cff583e8520d50beb435bf93e133b4dea697fa65e12df39c134b67177bd
Formbook
9c14d6ca77383fa5a3724feab17b217b900295abf77311a8c88f39ff7bb02f01
Formbook
d3be2ee3efb4181dfeeb50d0a3aec292733ab22c39ee474dfd7f3f18780f1224
Formbook
+ 469 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220508-3g5c8adecr/
Unpacked files
SH256 hash:
47a1b7e633dbfe5227f021deb30d806d9546e17044bef8dd54fb2cc21096a471
MD5 hash:
5dd5ba675cb35df77e879297c615548a
SHA1 hash:
1058ea7d6bb4f68b92e08ca7806a542afd32e67f
Link:
https://www.unpac.me/results/1e8884a0-6347-4bf0-a153-2c4a910509d3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/47a1b7e633dbfe5227f021deb30d806d9546e17044bef8dd54fb2cc21096a471

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_zgRAT
Create hunting rule
Author:ditekSHen
Description:Detects zgRAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments