MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a
SHA3-384 hash: 3e1cce34876d0c0637d79c3b2c7f527a60c740e371a37e70fd96f1686a640fd5938dfe124aa9bd402568a3a0a02cd9f8
SHA1 hash: 5c3a7b41d017bcabf9d441d81c6c46a05b76d0f6
MD5 hash: a93f5a2c6e1278d1b8b93e8e9b950f26
humanhash: artist-alanine-saturn-kitten
File name:6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a
Download: download sample
Signature Formbook
Create hunting rule
File size:799'232 bytes
First seen:2022-10-11 07:39:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:WAv2iN9IcvSoun3A1fLsumo2Hv3hqWxGAT8dTTip5Q+:f1rAn3A1DsucjGJ9+
TLSH T14D05E0371BEA4F4BC129B6B881D1C3B6A3ADDC01E567C3972BCA9C1FF04A5658760361
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318809/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.389.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63451dd381eef2a234c4c713/reports/948c9385-ecfb-42f6-a2f5-7c6c146d3187/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/804ba395-4546-4582-a298-00615a7f6fdd
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1087737
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a/
Threat name:
ByteCode-MSIL.Trojan.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-09-29 08:53:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3amdl4stvdiheddqvttkkwgziovnm3tf7yvttgqip733hkxoina._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:o5df rat spyware stealer trojan
Link:
https://tria.ge/reports/221011-jhjy5acfgq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook payload
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/533779af-915b-4eb5-ba97-2f78c4be1a3d
Unpacked files
SH256 hash:
d8f509f87fc41258dc81bb9720bdfa51638bf05853919ec3c3f352c39d516919
MD5 hash:
db7de8cdb8b497daba268a0c1617daa6
SHA1 hash:
81ab6e1a15c8ac64602677516c2ec9c86ab1fe80
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/a1222479-1eb6-47a0-b7a1-6d54fd67241f/
Parent samples :
89cfea22f0e899865a0ac9e825f5d5246c3c6d531e17baf401d577c9506a4ddb
541fba54f58a54a4f82358abd99656c7cea78fe068ec97cc207fc0c916456006
85764fdc121e61131878ca9389bf81d39950331c6f2edbe4a6a966f492b4d353
c36efec6a47aedadaf7b581deea921edf787839d068d1043c510f37a88abbb50
b9e916730b0c1a57b2a32a0a062e9c42944856c0fdf7f0d1273ffbb8c7d41229
db9bbd49b5b6cf0d0faa600dbdf08a4a56a3f3a37931c70792911481c4a56b24
d36979ad1aa8ebccccfa25f252fba3031183082e3571a20c539d567dde9456b1
3164f706acbe68f271528451bc6a469956d490a839d00a1194438d9e3c187c37
04ebda83a9530337b79f15e31315d1229cf4e74e5fee4d1347ed12d7b1126ebd
6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a
SH256 hash:
ecc741d80bddd6d0ebe2d2234def2e6dc83365889f2dba3cf53bbd4dccf80d76
MD5 hash:
cfe2a4e57e0c056b03f42955786bbaa4
SHA1 hash:
dbfbc8235727b3a92c28ab8b5f00599badb275a5
Link:
https://www.unpac.me/results/a1222479-1eb6-47a0-b7a1-6d54fd67241f/
SH256 hash:
95ba554cfc4eb408c985d706c23526d39d22675728b0eb21512f527987d435df
MD5 hash:
b52d20b06ffa3a0268a81f2bb61544ce
SHA1 hash:
a1b9080d72d40e44d17a54ba3f926d6096a2c1ea
Link:
https://www.unpac.me/results/a1222479-1eb6-47a0-b7a1-6d54fd67241f/
SH256 hash:
2470b39032f6182252039c88199016566b0de30c6aa02163a143427afedd12af
MD5 hash:
c3a1924684ca30ed22234ce1d9111dfc
SHA1 hash:
7347706241422758c06440fd6044ae4e042b456b
Link:
https://www.unpac.me/results/a1222479-1eb6-47a0-b7a1-6d54fd67241f/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/a1222479-1eb6-47a0-b7a1-6d54fd67241f/
SH256 hash:
6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a
MD5 hash:
a93f5a2c6e1278d1b8b93e8e9b950f26
SHA1 hash:
5c3a7b41d017bcabf9d441d81c6c46a05b76d0f6
Link:
https://www.unpac.me/results/a1222479-1eb6-47a0-b7a1-6d54fd67241f/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6ec0c1af929d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_imphash
Create hunting rule
Rule name:RansomwareTest8
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/318809/

Comments