MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6aecf2a84c05d52c3789b9b22ef5c046eed5dee698e2d94d61cda7219d32bb00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 6aecf2a84c05d52c3789b9b22ef5c046eed5dee698e2d94d61cda7219d32bb00 |
|---|---|
| SHA3-384 hash: | a2dfbc7dde1c5aa7d02cf70d1d26628e05dfca3354e1a79506bf64c55fea260b5117e841c5d1ce7eb75923a42170b65e |
| SHA1 hash: | 9a695bc5f0d99c6906f48151a8ebb15643956f75 |
| MD5 hash: | f73ab7df3c255fc1634f623d0ab2c09b |
| humanhash: | juliet-uranus-victor-emma |
| File name: | f73ab7df3c255fc1634f623d0ab2c09b |
| Download: | download sample |
| Signature | Formbook |
| File size: | 507'904 bytes |
| First seen: | 2022-04-06 15:47:24 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:dfXQwhlE8hFLBx/lhInMg5f/0BTpZbrWIczHVL5fxxkFksbupF:9lE8TLBxdeVeBTzWIcH5JxxkGsQ |
| Threatray | 14'623 similar samples on MalwareBazaar |
| TLSH | T100B40218F3BBDA26D5BC967390E695060370AB13E5A3EA4E17CC22D746077D50A42FE3 |
| File icon (PE): |  |
| dhash icon | f8e4f239d9b8f8e0 (21 x SnakeKeylogger, 20 x AgentTesla, 11 x Formbook) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Searching for synchronization primitives
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
formbook
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-04-06 15:48:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
19 of 25 (76.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 14'613 additional samples on MalwareBazaar
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:mj6u loader rat suricata
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
57fb1cea314c8c55bb795baffdb7bdf2e333fb8a88713179cf1fa292db26e56a
MD5 hash:
4aaa746e2f2146c48e7ae1282c88f93e
SHA1 hash:
3a8abe4d36b09bd3ccf5f93c9b277e13cdc62ea8
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
4bef7bf4c072898ac5bd164ecc1bec9c0a55de6c845a0f036554225c2ecd9b2b
MD5 hash:
92a3f66197558822dd473f9baddbcd00
SHA1 hash:
f21e36e837d8e3d561516e38cf0b9ef6d6f3b8e8
SH256 hash:
01c379b78dabcd6665cf4bcc10e8358bf4e93903b6e90fbb363b06a12952f838
MD5 hash:
777fa394312113b5a48bacf0f88f262b
SHA1 hash:
f114ecfb17faca5c26d46fd1cc67e35e087a017c
SH256 hash:
fe58122a2dc9f6b7c57eb945796affbcaa214b940cc31ea78bb3a93ec99b78bd
MD5 hash:
d4be86e94d2483566e3b788be1cf4658
SHA1 hash:
9e859c78492536bbcb13ce9a1efdebf5b73a6316
SH256 hash:
6aecf2a84c05d52c3789b9b22ef5c046eed5dee698e2d94d61cda7219d32bb00
MD5 hash:
f73ab7df3c255fc1634f623d0ab2c09b
SHA1 hash:
9a695bc5f0d99c6906f48151a8ebb15643956f75
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://45.133.174.55/900/vbc.exe