MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e519bc15ada2a71728074fba50228c1bdf1668e52c857d20f3d7c7e3bc9b5d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e519bc15ada2a71728074fba50228c1bdf1668e52c857d20f3d7c7e3bc9b5d2
SHA3-384 hash: 987fa4064acd79a9babcef10e2c084b5865291969b7886faa10efaf58470039ab3fe3edb5fff8b56134a8b6ed88b696e
SHA1 hash: 3684781b105520bfefe012d6db3c5126c97b603a
MD5 hash: 8469875233f6a64484841f05d32ddcc1
humanhash: sad-diet-robin-orange
File name:169287048457a86825251f86207de68fe71f770844a1efc159a89cc2088f3aec12c8185aa3881.dat-decoded
Download: download sample
Signature Formbook
Create hunting rule
File size:190'464 bytes
First seen:2023-08-24 09:48:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:Kk8bMpvDxx0bBH6P0n0ihbZ1hVz2C1kt2ykiweSVWRPWgosHTc4ug9J:Kjwr0bBHGmzhbjhhFet4WRPgHg
Threatray 1'822 similar samples on MalwareBazaar
TLSH T1BB14231638ABA168C0BED7F6ACFCA115A02ADC33268F54C965F3DB66F80655C60533C6
Reporter abuse_ch
Tags:base64-decoded exe FormBook


Avatar
abuse_ch
Malware dropped as base64 encoded payload

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
169287048457a86825251f86207de68fe71f770844a1efc159a89cc2088f3aec12c8185aa3881.dat-decoded
Verdict:
No threats detected
Analysis date:
2023-08-24 09:59:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ae32715d-9c0a-42f7-b9ea-ad3a53484594

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/444463/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6e519bc15ada2a71728074fba50228c1bdf1668e52c857d20f3d7c7e3bc9b5d2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e375b909-241c-43b2-bac3-805143e7a226
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1296557
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e519bc15ada2a71728074fba50228c1bdf1668e52c857d20f3d7c7e3bc9b5d2/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-06-16 22:33:00 UTC
File Type:
PE (Exe)
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nzizxqk23ivhc4uaot52kariyg67czuoklefpuqphv6h4o6jwxja._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2ba0e2aa5120cd3969463699261f1ffc71763fa001212564375d578e7301523f
Formbook
407cca2ad9433a2a222f9ab1ce14060bf6d5a5c041dc8d2b545257fd0be9e8b1
Formbook
959fc8883e6b1d4ab77f9738792435e2dae1969530f36d2672db6cb397778687
Formbook
9c3860c6744d8b2718e1109e327795014997a81b0e21706a96242d0f8d52f55b
Formbook
a1662b8e9f60ae12d014dc7bf567d136abef56c45d76b65c765c71d411c7ee8f
Formbook
a632288c7ae62bee60155ff916cd70e7ac14183b7789bcf64be9a186c0b75b0f
Formbook
dac75f90478b07cd9c53c36a4d2b01e73b7e31554a9bfec57bd328031ec15017
Formbook
db9bbd49b5b6cf0d0faa600dbdf08a4a56a3f3a37931c70792911481c4a56b24
Formbook
ddb24ba8d91f511ca86554d35f16cb9ef5d6103f5275c90217bc8ddb35111616
Formbook
+ 1'812 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230824-ltcejabf46/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
cdbf5841d7d4dcb47be9c6798c0f4d743b4d8e75cf26e18624d3af04da2c8b2d
MD5 hash:
3126c8c7af56fabfa3c8be663fd65c8f
SHA1 hash:
6b49c2a32efd95658aa91fb889957ca5f6e226b4
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/473f2c7d-aa38-448f-b090-b04463df3a4c/
SH256 hash:
6e519bc15ada2a71728074fba50228c1bdf1668e52c857d20f3d7c7e3bc9b5d2
MD5 hash:
8469875233f6a64484841f05d32ddcc1
SHA1 hash:
3684781b105520bfefe012d6db3c5126c97b603a
Link:
https://www.unpac.me/results/473f2c7d-aa38-448f-b090-b04463df3a4c/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6e519bc15ada/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/6e519bc15ada2a71728074fba50228c1bdf1668e52c857d20f3d7c7e3bc9b5d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

57a86825251f86207de68fe71f770844a1efc159a89cc2088f3aec12c8185aa3

Formbook

Executable exe 6e519bc15ada2a71728074fba50228c1bdf1668e52c857d20f3d7c7e3bc9b5d2

(this sample)

  
Dropped by
SHA256 57a86825251f86207de68fe71f770844a1efc159a89cc2088f3aec12c8185aa3
  
Dropped by
MD5 cc0557b198164c60281b28876bd1a0d7
  
URLhaus
https://urlhaus.abuse.ch/url/2706710/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/444463/

Comments