MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7496574bfa590d4e3b360f0a485e1d36571b1973fcbe23ec0236700090cc236a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | 7496574bfa590d4e3b360f0a485e1d36571b1973fcbe23ec0236700090cc236a |
|---|---|
| SHA3-384 hash: | 62538c99355f214dbd8ccbd247db21151231d519436c80d49e4a3f944121e3e4c1831090de37573b61e816625a5fae3f |
| SHA1 hash: | 52f349abe9ead3eed171fdd67eb9b2fc8b5546b3 |
| MD5 hash: | bdd4f6fed94ce135a729f834ebdf20c2 |
| humanhash: | california-double-papa-fruit |
| File name: | SecuriteInfo.com.FileRepMalware.18604.15295 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 921'600 bytes |
| First seen: | 2023-08-22 16:29:11 UTC |
| Last seen: | 2023-09-04 11:09:24 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:Sc/+311f4Mgm/RLr/7IrFF5smjF3gYV06:4hvDIR/F3gY26 |
| Threatray | 1'790 similar samples on MalwareBazaar |
| TLSH | T15415E03536261F92D6F33837AE04D5D3878214F65E6858FB5C1F310828CFA6A6605BBE |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
304
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.FileRepMalware.18604.15295
Verdict:
Suspicious activity
Analysis date:
2023-08-22 16:30:27 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
MSIL.Androm.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Leonem
Status:
Malicious
First seen:
2023-08-22 14:32:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
22 of 24 (91.67%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1'780 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
88c8e0866f31073d2b1af4c6b29efd1de92a8a8606b2b7dff71b1177a1be0327
MD5 hash:
5da9aca29ce2a27b89ca64f1303c4d73
SHA1 hash:
ead695fd9c4038337f8eeec65b2627293b814f3a
SH256 hash:
31329dc320d9045a64a27fc3e8e03af37996773f6c866e1b3519d6db473eaace
MD5 hash:
b8543a30ab57dfa41dcb087168eee7ed
SHA1 hash:
5694b6c2a7ac003d0c13cceb3bf50497bb19a307
SH256 hash:
ad50e09008236c471538d993a6d0b2e2dea7b2358bfb0c44c742178f6c6267ec
MD5 hash:
b39ba0d6bd5fabc562e77e189dfd6c6a
SHA1 hash:
c1246a975ae46327f606b4c2e949c9919dee2c22
SH256 hash:
0ebda6396782211f3e8983dc4b34996930ebf0ad1df17279260363b92055bf76
MD5 hash:
37e44c524a15a83e644fdbfd0aaf843a
SHA1 hash:
9bb040de324224f0d11dfbd797c88185d6db5909
SH256 hash:
caa93d38865d64f83f624ec031914b791d64f9db59e8b3eee021aeb3739c966d
MD5 hash:
1ae6b075dce2a243a0dc108437ca34ae
SHA1 hash:
6fe1b8178d20b8d68cd2cefaf04c6a711d32da07
SH256 hash:
7496574bfa590d4e3b360f0a485e1d36571b1973fcbe23ec0236700090cc236a
MD5 hash:
bdd4f6fed94ce135a729f834ebdf20c2
SHA1 hash:
52f349abe9ead3eed171fdd67eb9b2fc8b5546b3
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.