MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ac2dcd5ce04c588c08e4cd0350559bc8d5f7ff5c8302721619b74b39f61c786. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ac2dcd5ce04c588c08e4cd0350559bc8d5f7ff5c8302721619b74b39f61c786
SHA3-384 hash: cf1ad99dfb621eda35f14576c9649d9bb36643c7888fa64ce13c94a89c78daa60fa3b78d34dfa6cf94e9b6e6d2633b61
SHA1 hash: b48853c9e2eabbb5ba1c62563b46081a539088e2
MD5 hash: 3aa98571fcb0f1d734605cc6e2d8adf0
humanhash: apart-april-oranges-mango
File name:3aa98571fcb0f1d734605cc6e2d8adf0.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'120'768 bytes
First seen:2021-08-05 18:32:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'656 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:O+jrpNOT6PI1Vp+ZdNr7LpQo0rEHlKKS6k6+JIELfLfaybj3lc+GEQqLiNBA6LT9:oVc+GEQuiNB/eJ9KuzVcIITSNG
Threatray 37 similar samples on MalwareBazaar
TLSH T1F335E45DBDE47557F26B44BCB2C964E211B0BD0D8F18AEE7AD82F3EA019124AE537007
dhash icon f0dcf8dcdcd0ccf0 (13 x AgentTesla, 6 x Formbook, 4 x Loki)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
291
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://lupasgroup.com/Files/Hlt9VTppbZE9UGs.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-26 10:05:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/834ce482-4e60-427c-888c-292d1ce3d631

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/176804/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f31f5826-5f38-4ee3-82b4-38680bfd6c97
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/827630
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 460065 Sample: c4KjqU0vC6.exe Startdate: 05/08/2021 Architecture: WINDOWS Score: 56 19 Antivirus / Scanner detection for submitted sample 2->19 21 Multi AV Scanner detection for submitted file 2->21 6 c4KjqU0vC6.exe 3 2->6         started        process3 file4 17 C:\Users\user\AppData\...\c4KjqU0vC6.exe.log, ASCII 6->17 dropped 9 c4KjqU0vC6.exe 6->9         started        11 c4KjqU0vC6.exe 6->11         started        13 c4KjqU0vC6.exe 6->13         started        15 2 other processes 6->15 process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ac2dcd5ce04c588c08e4cd0350559bc8d5f7ff5c8302721619b74b39f61c786/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-26 09:04:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
32 of 47 (68.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlbnzvooatcyrqeojtidkbkzxsgv677vzaycoilbtn2lhh3by6da._file
Verdict:
unknown
Similar samples:
13d90261f73ecaa7455ccdaf16de6d96b122e8829cbf0ffe84ab89fc2cf4cad2
Formbook
815789972f5d16a6034b875a22cb4f733cc6761f8ae3c4e59928f7a131cb0214
Formbook
8b987ac35e194eb8c98666431ac30a66c4daae15e605679390dea2e72d9199eb
Formbook
a80660a551d427bd67935c0380d3edca52a17a57005dde154ba2acfd29bebade
Formbook
ac0c4591048b91693d05df6d5c00622a1b3cd0959d6e6bdbda49ea0e2a218007
Formbook
bd6455c559a9308054622aa9a30388d0ac83dd09af4ce4d1e9a715e2f1baeb53
Formbook
c2f77aaf305ed67feccf0a292e85a872c3d30499aae0311286e55c491f2bd074
Formbook
cbe7c0318d2f88aff2f18fc19a824bfdebcf2f7137d85adac1a5799afbb6876b
Formbook
+ 27 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210805-33267p55s6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
048ff0d4e6b6902b981dfb6295fcaded07fda06e52b3956cfab23d7fa725fe81
MD5 hash:
34be66dabd6d3fe296e5c876add7ce6c
SHA1 hash:
f3fba9c29c21ae916d7fcbec518432a14b38e5ad
Link:
https://www.unpac.me/results/2415fe69-5622-4048-9dd8-17725c2b2cda/
SH256 hash:
4ac2dcd5ce04c588c08e4cd0350559bc8d5f7ff5c8302721619b74b39f61c786
MD5 hash:
3aa98571fcb0f1d734605cc6e2d8adf0
SHA1 hash:
b48853c9e2eabbb5ba1c62563b46081a539088e2
Link:
https://www.unpac.me/results/2415fe69-5622-4048-9dd8-17725c2b2cda/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/4ac2dcd5ce04c588c08e4cd0350559bc8d5f7ff5c8302721619b74b39f61c786

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 4ac2dcd5ce04c588c08e4cd0350559bc8d5f7ff5c8302721619b74b39f61c786

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1508978/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/176804/

Comments