MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5adf7d2d4f1364dade98a5c7b94421458d87391204bf0123563766180e7524a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5adf7d2d4f1364dade98a5c7b94421458d87391204bf0123563766180e7524a0
SHA3-384 hash: bb82d12a6e2e77a2a6974fed140d20fe30fee2ef51d140bb9a08fb11e6a7804cc1df154cc0fb6750145c3cc871e45c7e
SHA1 hash: baa3ba95cd27c1f181dd18684c52eaf6db5f1211
MD5 hash: d0ef420f35bef2f1feca324ee433b057
humanhash: earth-rugby-red-timing
File name:SecuriteInfo.com.Win32.TrojanX-gen.16407.5120
Download: download sample
Signature Formbook
Create hunting rule
File size:912'384 bytes
First seen:2023-07-20 14:31:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:yOC426I5+p4+5VfBVfBVf/3rlDjfzUa37uGfeWb0:6x6I5W4+TfLfLfvhXzz7xI
TLSH T1D715EFB0FBEBCB16C38B0ABC547D3EBB039952D1B8D2968B68179C59A590F38044353D
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 19f8e0d0d4d4e871 (6 x Formbook, 1 x Loki)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
315
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.TrojanX-gen.16407.5120
Verdict:
No threats detected
Analysis date:
2023-07-20 14:34:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/683c7028-414e-4f83-bc6d-c38019bdab6b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/426296/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.16407.5120.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
60%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64b94563c7643f862f340ee3/reports/75a8311f-1576-4d5d-b64a-db8ba6f05835/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/5adf7d2d4f1364dade98a5c7b94421458d87391204bf0123563766180e7524a0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ade4beb-f49f-4a68-9ee3-f0fd2969bc0e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1276876
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5adf7d2d4f1364dade98a5c7b94421458d87391204bf0123563766180e7524a0/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2023-07-20 13:46:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=llpx2lkpcnsnvxuyuxd3srbbiwgyooisas7qci2wg5tbqdtvesqa._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230720-rv9z3shf3s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c3e2459954ece4f7d7b83677d1df9862e720d595e8a9aba7b214b833725a172d
MD5 hash:
51e4407fcf08cbc3f0d03b1628a80770
SHA1 hash:
55920b7b63e775c58e8cc611ee849702610c35f6
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/fee83243-d400-476e-bb3a-de4695e8bff7/
Parent samples :
4f46b17d1db8bdb30b33dfa8ed5335149bb4f920780e349b6b02155e337c8b57
c433841d01e8b7901e45455592fd6db08dd48b4caf2682d3222078018475de60
5adf7d2d4f1364dade98a5c7b94421458d87391204bf0123563766180e7524a0
SH256 hash:
ed64a7477371b98b059c283dde9eb172902d718f935e404333eabf67e855d11e
MD5 hash:
18bfc9443cbd1df7df3767e14c0ea0c7
SHA1 hash:
eaf5779203c7b8eabf571e6972e6449e2b4d9730
Link:
https://www.unpac.me/results/fee83243-d400-476e-bb3a-de4695e8bff7/
SH256 hash:
2043ad355562501f17f198681a6d19ff25bf9c149ee17142618637d05ee8fb7e
MD5 hash:
12a1abb6dd626e6c4e977dd84c3aad13
SHA1 hash:
fea886a294d16a074937f54013d1f7490ac50aec
Link:
https://www.unpac.me/results/fee83243-d400-476e-bb3a-de4695e8bff7/
SH256 hash:
30bb4e52f3984bcdd262d8ad3224ad14d0f2426da93f2479a1e6b94e9fc30155
MD5 hash:
29f9e1147f47779166332425eaf4709a
SHA1 hash:
29bafe2b69c148d3cf7e55feff2498f0810b02dc
Link:
https://www.unpac.me/results/fee83243-d400-476e-bb3a-de4695e8bff7/
SH256 hash:
5adf7d2d4f1364dade98a5c7b94421458d87391204bf0123563766180e7524a0
MD5 hash:
d0ef420f35bef2f1feca324ee433b057
SHA1 hash:
baa3ba95cd27c1f181dd18684c52eaf6db5f1211
Link:
https://www.unpac.me/results/fee83243-d400-476e-bb3a-de4695e8bff7/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5adf7d2d4f13/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5adf7d2d4f1364dade98a5c7b94421458d87391204bf0123563766180e7524a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/426296/

Comments