MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c0b46a75222d73d7c3b383335b4445ecbf1e4559b132dc64a291929128c04ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c0b46a75222d73d7c3b383335b4445ecbf1e4559b132dc64a291929128c04ae
SHA3-384 hash: 24ff81d01b68ccaf37b9519dcda07079d28d8f5013d57366c032db7df11903cdc8c057d0cfbe368c393816fa3f46d25f
SHA1 hash: 0cb896439279030d2b3660751d110c909560290f
MD5 hash: 82d72b9f11196d6a4c1da56621aa747f
humanhash: burger-sweet-uranus-island
File name:6c0b46a75222d73d7c3b383335b4445ecbf1e4559b132dc64a291929128c04ae
Download: download sample
Signature Formbook
Create hunting rule
File size:1'038'848 bytes
First seen:2022-12-08 12:38:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:DibznTknEBNx+te3lcvM2wv8Hbdf3yT+L74mBfNUstzo:DwngEBOte3qvTuMdf3
TLSH T10C258D0F2B7FDDF0EA245CFB121457039C3659E9BA8BCA7883946BC660F261C2B75464
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/344350/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.389-2.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/6391dae99a505ad9423e1561/reports/987209c4-21d7-43a3-93da-55255fff4761/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/90ead9e9-7a5b-4289-88f0-194c1a578b78
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1130779
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Deletes itself after installation
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses netstat to query active network connections and open ports
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c0b46a75222d73d7c3b383335b4445ecbf1e4559b132dc64a291929128c04ae/
Threat name:
Win32.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-11-21 08:24:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
19 of 26 (73.08%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqfunj2sellt27b3haztlncel3f7dzcvtmjs3rskfemsseumasxa._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:u2t4 rat spyware stealer trojan
Link:
https://tria.ge/reports/221208-pvmhnsaa38/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/48037e5f-e4ce-4a59-85d2-3fb14ed6e0e9
Unpacked files
SH256 hash:
959bd36359bbcaa56a2add5d7a34a96a326dc93cbf9423f242830570b31f94f4
MD5 hash:
bc0d16b08ecfb94a917bd18442054e3c
SHA1 hash:
925b845dccc589d6a65ebd0927786165e87e989b
Detections:
XLoader
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/d7ec3e90-2ba8-43f3-9a9f-1b5adf0c93a9/
Parent samples :
b93895bf25b4802252c954577edfceb1ec4288270bbd04a5aa6226f7c974774a
2382a65e62ea823df4d480c958ba0df9712521d74cbf85327f1279c6729f4797
6c0b46a75222d73d7c3b383335b4445ecbf1e4559b132dc64a291929128c04ae
bf72c2caa17e8d579ea996b2bf36bb251498e56e26375b88703f1d59289d9e80
SH256 hash:
782be9612927fe798168cb379202d7d4965a8f7271f4d4c73233e3fedcc05489
MD5 hash:
5bad6dcdad3c91897b544a21bac192c1
SHA1 hash:
5ed31cb612c82d1b61aec69b4074b8cf47378091
Link:
https://www.unpac.me/results/d7ec3e90-2ba8-43f3-9a9f-1b5adf0c93a9/
SH256 hash:
d206e3af122454a39258d63dd62f2dd750fa580fcd3efce320847ec89cbb20df
MD5 hash:
0ec22053ae1586cd43726d5e024d0f8f
SHA1 hash:
eae7ebb001939d481ed66b5fde3a890df212dde8
Link:
https://www.unpac.me/results/d7ec3e90-2ba8-43f3-9a9f-1b5adf0c93a9/
SH256 hash:
633ce90709936d7486ac3c3c7c52ce78a4810119fc7c5aef6bf24fbd63b416cb
MD5 hash:
cefb1c43e0f4445d634e8cc6ec20541c
SHA1 hash:
aecfb38487de93cc37256243708e3d7252450d4c
Link:
https://www.unpac.me/results/d7ec3e90-2ba8-43f3-9a9f-1b5adf0c93a9/
SH256 hash:
00e235f40a9e794b9d6cb9fb9244e321a4e632951bdb809044b0e2af07b98d35
MD5 hash:
48c6f000da9a80f92b48ef6099fa8a37
SHA1 hash:
9b43df5e56005d1ee03f16ff02f26e76272aca7c
Link:
https://www.unpac.me/results/d7ec3e90-2ba8-43f3-9a9f-1b5adf0c93a9/
SH256 hash:
7f272c4db499b1501a5ea1711d23de0e6a0c07faf16275e9b01722dae889c7c9
MD5 hash:
dd8b9511dda8eb7c84e1621046828883
SHA1 hash:
7f715270ffcadcba5c3148d2a0cecfaaf6c2e805
Link:
https://www.unpac.me/results/d7ec3e90-2ba8-43f3-9a9f-1b5adf0c93a9/
SH256 hash:
6c0b46a75222d73d7c3b383335b4445ecbf1e4559b132dc64a291929128c04ae
MD5 hash:
82d72b9f11196d6a4c1da56621aa747f
SHA1 hash:
0cb896439279030d2b3660751d110c909560290f
Link:
https://www.unpac.me/results/d7ec3e90-2ba8-43f3-9a9f-1b5adf0c93a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/6c0b46a75222d73d7c3b383335b4445ecbf1e4559b132dc64a291929128c04ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/344350/

Comments