MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52a12469debda778b4def88717f2e12641ecdbb7cd10e61669423e0b645c5854. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52a12469debda778b4def88717f2e12641ecdbb7cd10e61669423e0b645c5854
SHA3-384 hash: e2e23fb44d5231c40f44e4b5e3929ebb6ae487a3173f796ff273451595405d5522833df2c8d0fd3449139a02519a381c
SHA1 hash: 7a09f520992fbeafd1f51b2c765e6589c41c4c4e
MD5 hash: 895723ecb894b51c57338f452aa113b4
humanhash: alanine-earth-vermont-colorado
File name:SecuriteInfo.com.W32.AIDetectNet.01.29711.3896
Download: download sample
Signature FormBook
Create hunting rule
File size:652'800 bytes
First seen:2022-08-23 06:36:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:P/SRFu3XDG2bMLG4RU4rJ9eBBdqjfwOHzrLM+AGxx/gg+f:P/S4G25+wdqdHfL2iYt
Threatray 15'445 similar samples on MalwareBazaar
TLSH T17AD4232177A49BA5D82607F6842651C02B7A6F2B7E02EB5D5CE4B1EF48767032302F67
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon b0cf4a4c4c4ccfb0 (31 x Formbook, 20 x RemcosRAT, 18 x AgentTesla)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
325
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetectNet.01.29711.3896
Verdict:
Malicious activity
Analysis date:
2022-08-23 06:41:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3ff808f9-8805-47b2-9dfa-2d1dae740895

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/300395/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.29711.3896.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/630475edc9bbd990978a2d63/reports/71be7b6e-6594-4112-84f4-85dfb276c132/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e82d50c5-8e17-4493-8629-b1dd0a229336
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1056034
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/52a12469debda778b4def88717f2e12641ecdbb7cd10e61669423e0b645c5854/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2022-08-23 06:37:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
44
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kkqsi2o6xwtxrng67cdrp4xbeza6zw5xzuiomftjii7awzc4lbka._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1e6bdda859cf7324cbbb98eba3f817db4cc00f8495b93cbdd46adb64be1b3c01
FormBook
527180636ac4a7c151b634a5a186241456525c5ddaeeba7f418c5650ca8b141c
FormBook
54dad457608c666626603d6612ab44e1fc81049898e292d1511a7e684ea31cc6
FormBook
58ffed8f3b25296ea15a8f5fe71625db5c1ebad7776b4aa5df441cd0246213e2
FormBook
869eb8d82b8d7148e06b8545f0a69506d59f1bb8ef51eca9bf703b40391ff3a2
FormBook
917e03484856f0980f2150822a231e0f73e3cef3f074ea1644dcbd1082590399
FormBook
a1dcdeacfe74a7d50593567a1b29a4b8cceaa55168695c3c9946e12069d4b56e
FormBook
a7e7ce206966cd8a16bc3d80dc608740ea6dc81983c8a8481ad4754cc02163bc
FormBook
c8a52cd96047db62def2fc5fa5b631751d4444388918a42bbb8dcd0ba3e025ed
FormBook
fcdb032b3ca98e852552b0fef55d098f05cc1da4137cf0b50ef78837788202bf
FormBook
+ 15'435 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:s92n rat spyware stealer trojan
Link:
https://tria.ge/reports/220823-hdggrsdfe4/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook payload
Formbook
Unpacked files
SH256 hash:
244f58fb8f6fdf5e2d24c7892bc96760b28be3af800f3e1b8e3bda04bc6976f8
MD5 hash:
e5497328b8695bfcc1a240eb8651d62c
SHA1 hash:
8d006cf38cfd902abfe2dc65923e7eb84f7e11c9
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
FormBook
Create hunting rule
Link:
https://www.unpac.me/results/baff7ceb-4786-4afb-a25e-8936a69d99e3/
Parent samples :
52a12469debda778b4def88717f2e12641ecdbb7cd10e61669423e0b645c5854
68ecb3a0784bbfd4ac9f3d1c76cfc09cff02b4298839e2e1b293e9ef8833b265
5ed5d89c1712647161555baaee7e2a1e45e9aa5207f78dd338ac27d492966e2d
f29cbe65a3306988ba4e1945bce656ade7ce94fd178e354300bcd698d86fcb5e
8b3f833631b3860414b58ee9ac16688de84dc35ce0915dd6430ff34b5d063066
SH256 hash:
6c9a05c1f63ab32661826aa0681cf921bb3007f8b937b666fbb3624fe9f14546
MD5 hash:
80aacd60ae65690bb6f7c3db31d0b112
SHA1 hash:
d164a76b213bd7d7b5c326dcf51c250a1a050619
Link:
https://www.unpac.me/results/baff7ceb-4786-4afb-a25e-8936a69d99e3/
SH256 hash:
ceda93fdfce3ad8e4f800d4f2d940d793b68b4b0b254b652bf42e13dbd189ba7
MD5 hash:
786afe844ec1723b635cace747b60efd
SHA1 hash:
fa647a584a7fcad392147a182e3a2435b3ad5bb9
Link:
https://www.unpac.me/results/baff7ceb-4786-4afb-a25e-8936a69d99e3/
SH256 hash:
9b4aee132a0228378d66a57fda3a2030952309ef74cf2db724ac916b04d8c034
MD5 hash:
93c6391d23c1aa1ed66fb13f82f2ee31
SHA1 hash:
220098c3047c32b51ae13a5cc1e9beeef3da6e18
Link:
https://www.unpac.me/results/baff7ceb-4786-4afb-a25e-8936a69d99e3/
SH256 hash:
63a65239f3ec246c6cc5f47cfe81498e7e1bafeef4f9d02583205a606f4e7430
MD5 hash:
5ac20df51cb285aa3e37575d7beef0b0
SHA1 hash:
057dc6853c96fc35527e53b4c367e7d9bf7bb454
Link:
https://www.unpac.me/results/baff7ceb-4786-4afb-a25e-8936a69d99e3/
SH256 hash:
52a12469debda778b4def88717f2e12641ecdbb7cd10e61669423e0b645c5854
MD5 hash:
895723ecb894b51c57338f452aa113b4
SHA1 hash:
7a09f520992fbeafd1f51b2c765e6589c41c4c4e
Link:
https://www.unpac.me/results/baff7ceb-4786-4afb-a25e-8936a69d99e3/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/52a12469debd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52a12469debda778b4def88717f2e12641ecdbb7cd10e61669423e0b645c5854

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/300395/

Comments