MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 718d93188640d8dd5261f070a4b0df7575e9c4ecaf2e7b7146305f7a53bab9c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 718d93188640d8dd5261f070a4b0df7575e9c4ecaf2e7b7146305f7a53bab9c6
SHA3-384 hash: bb94b5e85b3a686d91012e0ea83dfb4b6bb5d48e00f4bba3d4beacb1601a4e3974c2dab781b84b40ec2294311d71a985
SHA1 hash: f6e937d361ec3a2fba6505bde47e36322ab481d1
MD5 hash: 1c8919262f3cc209a3af709712c23a4c
humanhash: purple-august-enemy-sierra
File name:SecuriteInfo.com.Trojan.PWS.Siggen3.25377.11844.26141
Download: download sample
Signature Formbook
Create hunting rule
File size:1'203'200 bytes
First seen:2023-01-19 22:29:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:MlS45nJrTmHkFrVoaqnGMGdDv/oE1DAc4prQm5ogrLEyY+o2+9RJ1Tifp18Xq4HV:6S4PkkFr23YDvtZt4p8mtoHRJJgp18
TLSH T17D458CC5966242E1ECB589383AB8EE3527278C9A47284C7D2CC73D3B5CF631B1066B57
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon c1c1ccc8ccf4d47c (1 x Formbook, 1 x AgentTesla, 1 x Rhadamanthys)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.PWS.Siggen3.25377.11844.26141
Verdict:
Suspicious activity
Analysis date:
2023-01-19 22:30:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6761d7e9-5db6-4622-a190-7f7f451e9bfe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/354764/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.25377.11844.26141.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63c9c46f1c9cbf7d62507491/reports/ec9dc6d4-707b-4945-ad9b-34d31f5d3fae/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/57aad1a9-bd17-42e6-bd04-5fefd988c2c8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1155157
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/718d93188640d8dd5261f070a4b0df7575e9c4ecaf2e7b7146305f7a53bab9c6/
Threat name:
ByteCode-MSIL.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2023-01-19 22:30:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
48
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oggzggegidmn2utb6bykjmg7ov26trhmv4xhw4kggbpxuu52xhda._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230119-2es2qshf35/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
30dc6087da2b00d1fc3f1a333ba668acff9303a235fa4269fc83400afbf748e6
MD5 hash:
3a9baa3fdff7c4b632c18c29149af180
SHA1 hash:
b80250db474debe4e47f1c673fdb4aaf4ae9bfe7
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/797069aa-37d0-4f6d-8d6e-f8e335c99a5d/
Parent samples :
17310a407cf725a962dffd7d620f9bc625331a3b82f4588f882ceffd859ba13e
293fd960e74b47494bc97ded006d308f638e49d5886e664957331a4d1e67ea7e
718d93188640d8dd5261f070a4b0df7575e9c4ecaf2e7b7146305f7a53bab9c6
SH256 hash:
913ae88cfcbad5957ab68de0c030e708ab57304eaecd8898eb4c9176b24d37db
MD5 hash:
77026d6c763afc294ca4df46be7140e4
SHA1 hash:
ae69bad30029b28a40ea1bfe84d0dd7b62551e30
Link:
https://www.unpac.me/results/797069aa-37d0-4f6d-8d6e-f8e335c99a5d/
SH256 hash:
b4f537fbf5f55ba0ee553e2be9eaa9d742b2d8a42315963481ef3116c0ef02be
MD5 hash:
def425c5c572001013bf02032047251f
SHA1 hash:
e7f88222c9a900e02082fdf30ae1b8d3cecb031c
Link:
https://www.unpac.me/results/797069aa-37d0-4f6d-8d6e-f8e335c99a5d/
SH256 hash:
ab2f8dbc2b147528cecac6ea1a8886951c424be0b2026743b39d97f0cbabb04c
MD5 hash:
77ab42f4bbbf4565846eb8953192d71f
SHA1 hash:
3c662c756cc31867c0473716a74e777a65ced550
Link:
https://www.unpac.me/results/797069aa-37d0-4f6d-8d6e-f8e335c99a5d/
SH256 hash:
025882be53c32910bad76c0cddb8affff852fdf05e33c9a45ba6a95222df6efc
MD5 hash:
48b0596009c603ed9f506a3a0d2f87fb
SHA1 hash:
3b428cd269c275267f4de73a86a6e7ceca3c070e
Link:
https://www.unpac.me/results/797069aa-37d0-4f6d-8d6e-f8e335c99a5d/
SH256 hash:
d8f7ba958afb057069e11071568b50e442e3b78d7ebd7eda6cfc3e16fa5db0be
MD5 hash:
9f18c1fccd09885cdf61a5f8c537a17b
SHA1 hash:
2109cfc9d31dee8736a15a0e9c867f442a44e38c
Link:
https://www.unpac.me/results/797069aa-37d0-4f6d-8d6e-f8e335c99a5d/
SH256 hash:
718d93188640d8dd5261f070a4b0df7575e9c4ecaf2e7b7146305f7a53bab9c6
MD5 hash:
1c8919262f3cc209a3af709712c23a4c
SHA1 hash:
f6e937d361ec3a2fba6505bde47e36322ab481d1
Link:
https://www.unpac.me/results/797069aa-37d0-4f6d-8d6e-f8e335c99a5d/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/718d93188640/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/718d93188640d8dd5261f070a4b0df7575e9c4ecaf2e7b7146305f7a53bab9c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/354764/

Comments