MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70
SHA3-384 hash: 05680826e675646dc3e904df4d04c20036556f140db6365f3972791498367b5d1afab17b74744d2575a364a79e57927f
SHA1 hash: 492fb1126536ddcf687cf6ab527c4fbfaef5dbdb
MD5 hash: 5af999fe6d9b7d0031283b55ec7e3b9f
humanhash: finch-yankee-edward-lake
File name:6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70
Download: download sample
Signature Formbook
Create hunting rule
File size:186'368 bytes
First seen:2023-02-07 09:24:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:6PWoAenxbOre3VWiID4UuokpT1p7HcYAwqflupCRWYze7x0kPNqv:fSQiUiokfp7pAwqNuPYy7ykFqv
Threatray 17'531 similar samples on MalwareBazaar
TLSH T1640423114BD144BAE476F83F690F58BA6F2F4E66A12A20625B5DDC19BD043F434B3D07
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70
Verdict:
No threats detected
Analysis date:
2023-02-07 09:24:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0b7e6255-5712-4b7f-9f04-69287f40ffa7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/361317/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching a process
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed razy xloader
Link:
https://www.filescan.io/uploads/63e218ee447edb203a0308a8/reports/060175e0-adcb-4d08-ade7-44bc715f91e4/overview
Verdict:
Malicious
Labled as:
Ser.Razy.Generic
Link:
https://www.hybrid-analysis.com/sample/6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ece73f91-b9f8-4242-84aa-fb35fc1fb198
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1167513
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-02-07 09:25:06 UTC
File Type:
PE (Exe)
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ny2ynu6xgjd6sa4wnwzvdrtoj2ty3jvdmbyrmeu2u6pkypa3fvya._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
128505a47c9f43ff7ee232ae8e617756b0fc1bef2548dd893245514008dfbe58
Formbook
17310a407cf725a962dffd7d620f9bc625331a3b82f4588f882ceffd859ba13e
Formbook
27715b211a7693bd15a4580b6ee1e9b9d01c2b1142170b47888b7be538ecb084
Formbook
39156092712f27714fed918a43876cd6b85c9ad6d3ab6b96fe22e49eb2f34346
Formbook
5255fd7c0d9904892ed2a92ff1d08e73d59012e206c52a6865a6f6cd5f081479
Formbook
c7627adc0797d3315c2c942356c8cb1fca39afbd0335512236be79a6e2f7acb3
Formbook
fe8dfa5a692cbfdcc238b360d8e7e2f07b673d7d7645d9d2a2eabd245213457c
Formbook
+ 17'521 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230207-ldmkkaag83/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
53ddcf4e038a4d5d1214df3050c797b23f3ae6f2f1a32011fe1f018355a433f0
MD5 hash:
2378dddfaa3914ae19f932b482aed6ef
SHA1 hash:
0e3ce8159d34c12daa2616aba686e2b05723aa35
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/1d276b8d-8945-4ee2-8437-e78aefb2fb85/
SH256 hash:
6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70
MD5 hash:
5af999fe6d9b7d0031283b55ec7e3b9f
SHA1 hash:
492fb1126536ddcf687cf6ab527c4fbfaef5dbdb
Link:
https://www.unpac.me/results/1d276b8d-8945-4ee2-8437-e78aefb2fb85/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6e3586d3d732/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/361317/

Comments