MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
SHA3-384 hash: fa0e90be895e1838e72ad5dff1933b9c6719534d47408174c21a055328ecd9189e7fac5100bfa3a903fdde548399e489
SHA1 hash: 4b5bf6e512d4971aa85e3e279f931eb6d33105ca
MD5 hash: 28054120effda1f940bff3c6fb9c125b
humanhash: princess-happy-blue-thirteen
File name:28054120effda1f940bff3c6fb9c125b
Download: download sample
Signature Formbook
Create hunting rule
File size:704'000 bytes
First seen:2023-07-18 05:33:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:ox9pR5AITvJYjXaiUp2m65HB38Tt4lLHEbVdrDImvsYeduo9Wg0nqn90u5iI2dxf:ox9pDAqvJ0Xc2L5HB3WilLHEzYmvsYeK
Threatray 3'283 similar samples on MalwareBazaar
TLSH T12BE42301AC66A713C6926FFE6240733147AD4FE5641BD36A0ECBF2E6ED36B804B11197
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 70d2a28e3c626cb1 (4 x AgentTesla, 2 x Formbook, 1 x DarkCloud)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
28054120effda1f940bff3c6fb9c125b
Verdict:
No threats detected
Analysis date:
2023-07-18 05:34:25 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6d674fe1-c510-478d-bd59-060c7ee1da3c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/423204/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.68137976.27269.14704.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Restart of the analyzed sample
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook packed remcos
Link:
https://www.filescan.io/uploads/64b6244bf3c193545ac62d8c/reports/41b486a1-32e7-4f7b-8d74-271ed2e82990/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0e49faa4-3105-42d5-9599-ae9d1238baac
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1274846
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-07-13 07:29:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=muimhcdorxplbn5rmt4rltnvv4zwelm7myvu56aum6phkzl5v7yq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0bdde3cb5bc10aa2aa88e00599e59b6ebfb1ce24fe78dc2871ba3c8118f61c91
Formbook
10431b996eebfb109db1ffbf5f789d750cae0942f011591275f086e4cc946498
Formbook
2dbe70cbbdcaf38adeeb141e74dd76d8c2bf2f3d3ad7d4e9b6ac2b75aac70b53
Formbook
56ad658ef29551d86add3dc7f16538402f1d894ec746bdf14444a4b01deabda4
Formbook
7997a727f9b2d2bba8f6a846dda7f4640c5b3d1d31db85deb0ef1c4ff05574a4
Formbook
8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
Formbook
ac0ae00f56127b9a2036156b7fb50c8eb65347d8773ca8a6e5ca0f92cc39ca59
Formbook
de30e038eaa635585c23ec16221f9307e49152fe0d42d6f49a9435beb42f1f9f
Formbook
fed0556f87884c7d40eadd3e2f22d432da0b5854edda4404a936f5b66e00b534
Formbook
+ 3'273 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230718-f9expsgd89/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
341600e5fe8f53faf04eadc6390e471dc2444ab28691514af8b74c8b561d9a5b
MD5 hash:
67663152c1f736896ce8322eafc835ff
SHA1 hash:
4820664daf28d13d8c9ca922fd86d46c6eb7bff1
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/8a07422e-c832-478f-9ca4-1dc2502c157a/
Parent samples :
8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
fed8358d2eb6cd687bb6f6a88b4f8bc01bd5dcf355535532718a0f04f1eff674
c7616a546f8e22dd0a80b275f5991b6c6ab567d278be339904d6bff0c5c00a42
9e9af76a8585a7b99a59f042f64a711aaa8f9bfb68a4040ca522147470d6b6de
72d3a95a59ccd8220e04850fb54fdc48caa51c10739d96afa48ab5446303dc07
5348bcccead193b46acc11339b9c3ff05395753d536a0952641af34382e08604
20d45ab8062d59db6229e293a604f37e2760519894d07380288f0f8f5e2b5c95
adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c
a0c810baccbd3943748568d16e5b9cdf6b829364c8e4b21cda09c4f865b228f0
5e0519cad57279ab39f475c7ec22d2435a4a69f2378cf2254745e089f5c174fb
8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381
31fd5ab4ff38fd42399d4d90a19da71b94cd7ba47b0a97ce1bda37958ce97ef6
SH256 hash:
78eaae7f782e4b12d7d47f290ddaae74c19373393bb86673fb25633b7fcbc7c9
MD5 hash:
be26954f9951b84a519797424fc52ee1
SHA1 hash:
8228036eb552bf7679f37cbd463d3f911d29964e
Link:
https://www.unpac.me/results/8a07422e-c832-478f-9ca4-1dc2502c157a/
SH256 hash:
22030e358456ba91c089d024caae3adea72098c67ea91de93b3fceaf77103aae
MD5 hash:
a7e906727004ef0b90c454262e002d9b
SHA1 hash:
ddf689e24bbb13b5ce63a9f26b081a13b382a6ff
Link:
https://www.unpac.me/results/8a07422e-c832-478f-9ca4-1dc2502c157a/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/8a07422e-c832-478f-9ca4-1dc2502c157a/
SH256 hash:
eb6b6d2bb8a733c777f6e98e3cbc9d6574a7df072c595fdfdda4b50c7a94434d
MD5 hash:
3a4f71caef80b7d4c2f8f0fbfda330dc
SHA1 hash:
7247933584adb4954d1032a05e9813317b44f534
Link:
https://www.unpac.me/results/8a07422e-c832-478f-9ca4-1dc2502c157a/
SH256 hash:
6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
MD5 hash:
28054120effda1f940bff3c6fb9c125b
SHA1 hash:
4b5bf6e512d4971aa85e3e279f931eb6d33105ca
Link:
https://www.unpac.me/results/8a07422e-c832-478f-9ca4-1dc2502c157a/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6510c3886e8d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2684911/
Cape
Cape
https://www.capesandbox.com/analysis/423204/

Comments


Avatar
zbet commented on 2023-07-18 05:33:54 UTC

url : hxxp://103.57.130.167/spaceX/csrssop.EXE