MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 781885641b6240ed39035267247cb80877882d4502605504e78463fab654b0ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 781885641b6240ed39035267247cb80877882d4502605504e78463fab654b0ee
SHA3-384 hash: 38145328ecb28113e34b92fda596148c4f8d6f214d6a39db9abb3be156180b4c4a6f9ea934ea1b087b7a41cce475d5c9
SHA1 hash: 61e47e35a95e5ef4a30d93b0da20b59814199712
MD5 hash: 1a0c6172238ecd95ee2a4ddf8eb17131
humanhash: golf-uniform-one-fish
File name:SecuriteInfo.com.Trojan.Inject4.61718.16406.11698
Download: download sample
Signature Formbook
Create hunting rule
File size:611'840 bytes
First seen:2023-10-10 02:49:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:8MYnQ3j67SESV1eXl8OhA90TWtKwhhBKeP6br736lt5M7uavGcGDnQFG3kfS5pDF:8BTWzhyeCbrWlt5qnDenQo9EZFs5
Threatray 43 similar samples on MalwareBazaar
TLSH T1D4D40140A3F2DC80FBFE66B98CE285255B797A173202CF9F6DA0537D41357929201FA6
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
310
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.61718.16406.11698.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Likely Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6524bbdbbe42b2ac8e6136bb/reports/3e8f64cd-0c8c-4fe4-9466-71ceead9173b/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/781885641b6240ed39035267247cb80877882d4502605504e78463fab654b0ee
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5efb4a97-c3e9-49f1-a6e6-02afdaa4a1ab
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1322527
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/781885641b6240ed39035267247cb80877882d4502605504e78463fab654b0ee/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-10-10 00:44:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
23 of 34 (67.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pamikza3mjao2oidkjtsi7fybb3yqlkfajqfkbhhqrr7vnsuwdxa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
382569a59d1fb65e1d9a987191305ede9fc0f51219ec1b6dc281e21bf1e53db2
Formbook
3e940bd501847e7bf60b525599626211d32f705d7c616584629a5dc0206bc52d
Formbook
703ecadd8d32ae22f4379b418bb1690ea42e4d38657bc4f5766ee20b8c154baf
Formbook
942dc34e908c79f017a488c349ee4702f6a4e55d1e34210bd94152a4d0e97d70
Formbook
ac10fa3a6b7cfc8385aba614ca8f0da49fe6b0cb6f1b939ec0f0046ecf80ca64
Formbook
cc74e95443838d54168e736be39859926097fd7da7606b6ef4d8bfb794303eff
Formbook
cecee88a7617e74a94da62a630b47509785f2d0dd45bae200fba376915eff317
Formbook
efb834b38792a7c5f000b0683aa6fb5999fd2c0d6dfda9ba417f990fbe1041b5
Formbook
+ 33 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/231010-dblaqacc39/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
162a946816a425a6fbd720474232285b352bf83cb16c7a65edbd1bd281615168
MD5 hash:
c35fb6c6d0c832b80007e7d894d8aedf
SHA1 hash:
caf8f365a0015485e6c7f29fb2f57b0a312cee2a
Link:
https://www.unpac.me/results/0d4e5e3f-8a52-447a-bfe2-676039931811/
SH256 hash:
e9cfda5e815e0cc4abd0bd1b033a456d99a7c12e6809a4cd90a6aa066269dcba
MD5 hash:
7e10d04f96e992dc2ac2c238033637bc
SHA1 hash:
0dcb97db75c11256f6f0f374e19fad6ddb4f65db
Link:
https://www.unpac.me/results/0d4e5e3f-8a52-447a-bfe2-676039931811/
SH256 hash:
65e47578274d16be1be0f50767bad0af16930df43556dd23d7ad5e4adc2bcbe3
MD5 hash:
848b847cd19805d19235b5acb8ef2bef
SHA1 hash:
38100751a4ae45a143232cbacf9bb441b31fb211
Link:
https://www.unpac.me/results/0d4e5e3f-8a52-447a-bfe2-676039931811/
SH256 hash:
65daa2a8f3d1388322ab5ff50aa86e8b361452bd0a74d588d9c0819adf4a3cb7
MD5 hash:
4cbbb07fd303b4d906a452495b771078
SHA1 hash:
0ac88054b699f25d8af5be34dc7e305d84bdcd5f
Link:
https://www.unpac.me/results/0d4e5e3f-8a52-447a-bfe2-676039931811/
SH256 hash:
781885641b6240ed39035267247cb80877882d4502605504e78463fab654b0ee
MD5 hash:
1a0c6172238ecd95ee2a4ddf8eb17131
SHA1 hash:
61e47e35a95e5ef4a30d93b0da20b59814199712
Link:
https://www.unpac.me/results/0d4e5e3f-8a52-447a-bfe2-676039931811/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/781885641b6240ed39035267247cb80877882d4502605504e78463fab654b0ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments