MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5b39db4d27b6a3c5822a06632dedb65df333f7ab938433ed4761eaf88cebf4e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | 5b39db4d27b6a3c5822a06632dedb65df333f7ab938433ed4761eaf88cebf4e8 |
|---|---|
| SHA3-384 hash: | e957c6d2e4dc4d1bd2609151011d72578edb301bf669707b3e4bc1c10571553f8fcc12962c76cd1d0f5c2823f2ab0dac |
| SHA1 hash: | cadfbee2f61187dd24a0bd852fe9edd1be05398e |
| MD5 hash: | 4667024ed95ec4e44ef227048e8ea189 |
| humanhash: | alaska-undress-golf-freddie |
| File name: | SecuriteInfo.com.W32.AIDetectNet.01.21706.7698 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 678'912 bytes |
| First seen: | 2022-05-25 21:33:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:lGZFF0U/DfnZzE4xIvf0F32L0KiewPhRlAmh0huol5Knk:UFzHTyRClAmUuook |
| TLSH | T1BDE4010AEB22B9D4F57927FE303559A92F60A722D8BDD95C689131970CB43C3409BEC7 |
| TrID | 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
324
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetectNet.01.21706.7698
Verdict:
Malicious activity
Analysis date:
2022-05-25 21:37:32 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
expand.exe fareit obfuscated packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
xloader
Threat name:
Win32.Spyware.Noon
Status:
Malicious
First seen:
2022-05-25 14:18:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
11 of 26 (42.31%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:vecn loader rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
e8ad8f1198c2cbb1550a6da142a35c710da8ca71b30788b41da6932fb8714aca
MD5 hash:
c5709a6fac3e442fe7e21d6b55406ace
SHA1 hash:
b508a4e7c36715b0d325dc04951198b3d9efa4b8
Detections:
win_formbook_g0
win_formbook_auto
Parent samples :
0d6f7d870b27c6d1ad339d5d8f964913ca3830465ad33bc499b64c034991bc66
5b39db4d27b6a3c5822a06632dedb65df333f7ab938433ed4761eaf88cebf4e8
03fa6bc991b15a3d5cd507673d1cccd0b0279315e9a04924d908a9520609a1c3
3d3f87ccf17f08c06cf2b27159f134cdbba6a97e0b127bac605a4ccb09aab01e
04ec2e85da90b75bc6e711cc8ec74b7a79e16722652d944ff9fef180f3bdebaa
5b39db4d27b6a3c5822a06632dedb65df333f7ab938433ed4761eaf88cebf4e8
03fa6bc991b15a3d5cd507673d1cccd0b0279315e9a04924d908a9520609a1c3
3d3f87ccf17f08c06cf2b27159f134cdbba6a97e0b127bac605a4ccb09aab01e
04ec2e85da90b75bc6e711cc8ec74b7a79e16722652d944ff9fef180f3bdebaa
SH256 hash:
ee0ba7864b15d89c3fe24acf31195eb89e4651ab145de0b26f9bc76689a7b5e3
MD5 hash:
15a5c0cc867c4a7e955d396dac877385
SHA1 hash:
ea97e48991e41fe0ded3457f71e2721eeacab089
SH256 hash:
c720d8d87e5744ef459c160ae3ae85984519c5cee89d4acd3d4156f929ebcca2
MD5 hash:
86f922d84e1b89f646bc23cb3d878a9c
SHA1 hash:
b61f4401c1a144d704988cf4e55dd9a71f8d8263
SH256 hash:
5a1e9dc7bbdfb4ec3ea339acb4285ac79fba3e7636e1340430879c638a08d017
MD5 hash:
fa4c0e23e94b7eb706837742aac80248
SHA1 hash:
7c6d03d05ce6ecee85ab2980c3404494e262a1a9
SH256 hash:
fc67f3db71e98f1a9d25bd88082adf61de9d8686fc264f32970c3ffc7663419d
MD5 hash:
2b1907a6b7220c1370cb11d4a7247b08
SHA1 hash:
5896373126f0d4fcb1d9a7ccf54d82e50f9a0fad
SH256 hash:
5b39db4d27b6a3c5822a06632dedb65df333f7ab938433ed4761eaf88cebf4e8
MD5 hash:
4667024ed95ec4e44ef227048e8ea189
SHA1 hash:
cadfbee2f61187dd24a0bd852fe9edd1be05398e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.