MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
SHA3-384 hash: a9659a7bf11d95635188f21819e65ddfe66b5c5ac6aca479edb2a6d0c8074f5ec9570201f188f778a28ad2e84f13fe76
SHA1 hash: d89ead114739085e2c99fdb584e207f4398531fb
MD5 hash: 740e2966f0bb96982a15acf39b361819
humanhash: utah-montana-sodium-magnesium
File name:5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
Download: download sample
Signature Formbook
Create hunting rule
File size:627'712 bytes
First seen:2023-08-08 11:09:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:df2iN2GULU3/zZ409voNtgsP/qhtpk26vlqw2+XNsiGCBS:df1xULU3/zbU/4pR6sw2+X2iXS
Threatray 3'650 similar samples on MalwareBazaar
TLSH T1FAD4126731AC5F18DAB793F468B4584507F1F90FA1B5C3252DCA22EE5B22B101AE1F27
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
262
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
Verdict:
No threats detected
Analysis date:
2023-08-08 11:08:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6168670a-88f7-4d78-8462-d555c99712de

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/441322/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64d2228b4154db2bd521bd4c/reports/8d3680f5-08f6-4e14-95ed-1ac7c8381f86/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cc1658bb-ac94-4db9-af59-9dab892f5a0a
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1287684
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1287684 Sample: p1VHC6BgtE.exe Startdate: 08/08/2023 Architecture: WINDOWS Score: 56 15 Multi AV Scanner detection for submitted file 2->15 17 .NET source code contains potential unpacker 2->17 6 p1VHC6BgtE.exe 3 2->6         started        process3 signatures4 19 Injects a PE file into a foreign processes 6->19 9 p1VHC6BgtE.exe 6->9         started        11 p1VHC6BgtE.exe 6->11         started        13 p1VHC6BgtE.exe 6->13         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210/
Threat name:
ByteCode-MSIL.Spyware.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-07-26 00:50:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
25 of 38 (65.79%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ll7r3ohuy5ezgpgyq2pb5ahqadsme7phydd2punklhcpgjcseiia._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0cc4308eaf906783b45db5c75d2bf7e5a0b74d9d531dcce595604c1f436d4fb4
Formbook
1bf9eea6de3a59ee58e13e33175ffdd66c6ba4a187b4df949593853c43784afe
Formbook
83705fb44730441949f46455f2076211d6f9d3739a622bb277d3e9c03ddd592e
Formbook
8d9ed6e86b3dd8272711c008c10d4b62f094bf98b84b87b2d18e0c5960d03a74
Formbook
9704a19146f3fb0b491a65fa62d39c72d4c0ebacd5d7128dcfcda43400bb05b4
Formbook
a06ac680f7c3454cdfe9e777f1dc9e6867e3556d323986c428aead576d2ede5c
Formbook
c1b9e627f3beaa8e365c0bdc240435e2eaf47b664d28d1c2c2fd859bd9373d7e
Formbook
c69b660c246706c03fa2a9ac42c9947515de273b76cde68c62549a6d9f5e3e9f
Formbook
e3643d141c0e87b3304f3b015f1e8dbbbe273e9a8bb93906991fe61a3073f891
Formbook
e4a8f592359f1b3e0f6cf104c7c773ed5c249a02bfd8d770e459a074a87fd259
Formbook
+ 3'640 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230808-m86scsdg2t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
043961098da7adb01104bfe078e0a9ba8ef1581c08c182bda7dbe321f9a2cbe8
MD5 hash:
70898a3cb1089c9bfead550b36b55d88
SHA1 hash:
9deebc8dad032b8c062744e0cc7f211d390c7c5d
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/163900f6-931f-4d48-8c3a-d73082479edb/
Parent samples :
5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
6eeeec436d7abca44202ca9e5f3e20d2bc6a7f4adaf240e1ba5ab41e94890c29
8ee018d985fc1492a623c99ffdcd39c768a0cdeb975d791ebd3a1c372ff2128a
8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7
afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4
SH256 hash:
eb3c14db4a7fe19d173136aed70921e64e0f45381a556f0f87ecb0f4f9ce8a8e
MD5 hash:
f95951ec1268bf89deb167d4ad8074c8
SHA1 hash:
f63707eea9536bddd0abb93683342b53c1e850a4
Link:
https://www.unpac.me/results/163900f6-931f-4d48-8c3a-d73082479edb/
SH256 hash:
aefce4c6c02cdb55db0b8d6ab5f28802b709eb2c2aa7bdc9b5f9739950ae890e
MD5 hash:
3a9edef35c66144580e326c8f791a1e9
SHA1 hash:
83de131ead8c32730cf7f7020941ae737712d86b
Link:
https://www.unpac.me/results/163900f6-931f-4d48-8c3a-d73082479edb/
SH256 hash:
4947a76e9a9aeaf91c79b27570c2ce43b821071564f2c55815d95605875275e8
MD5 hash:
ad1fcae00f5325eb4cbb18802689617f
SHA1 hash:
2e02f174362db5fe5ea944d9711ec99b2ce13e76
Link:
https://www.unpac.me/results/163900f6-931f-4d48-8c3a-d73082479edb/
SH256 hash:
08ebc622e0cf878c97baa286ee4d9ca2a33c3544ea8ee31d354ab2c165677cfb
MD5 hash:
79f2944e7669b3ecfdb8e567ae984ed3
SHA1 hash:
0aecc113ab5bff85050a3fe14560766801a38331
Link:
https://www.unpac.me/results/163900f6-931f-4d48-8c3a-d73082479edb/
SH256 hash:
5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
MD5 hash:
740e2966f0bb96982a15acf39b361819
SHA1 hash:
d89ead114739085e2c99fdb584e207f4398531fb
Link:
https://www.unpac.me/results/163900f6-931f-4d48-8c3a-d73082479edb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/441322/

Comments