MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78976f38ca4b4e62ead97e1222faa8ce79c0f9a517ef57bdeae4dc3f2c834d1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78976f38ca4b4e62ead97e1222faa8ce79c0f9a517ef57bdeae4dc3f2c834d1b
SHA3-384 hash: 03c038f327c78b7f193d1c7b861e7706742979b6fd2d70a7755338d5e1f526f403737e9f220b49e7d42f6a7fee85e7b7
SHA1 hash: 20f1200c08ab402837e3eb9ded0d64f47978ac12
MD5 hash: 2afd3b606ea6b1e9739fb9612b1f9031
humanhash: beryllium-triple-winter-berlin
File name:CheatDownloader.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'438'208 bytes
First seen:2025-03-30 10:35:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:54Y/AlpSo2UXuwwpimNLAEPcxxY/4C5IW:5RckwwpimNLAK4C5I
TLSH T14E657D11BFAC4A67C58F57BEFCB2691303B2E8012153E70B5684A69D1EC27858F0A7D7
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Anonymous
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
517
Origin country :
RO RO
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CheatDownloader.exe
Verdict:
Malicious activity
Analysis date:
2025-03-30 10:38:39 UTC
Tags:
uac evasion
Link:
https://app.any.run/tasks/100211bf-07f8-41a9-a0c0-6797b2f27460

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Adwarex-9851111-0
Create hunting rule

Win.Packed.Bulz-9891112-0
Create hunting rule

Win.Packed.Tedy-10017583-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67e9214ccfd0a37f830a1c36
Tags:
autorun emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a file
Launching a process
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Enabling the 'hidden' option for analyzed file
Running batch commands
Creating a process from a recently created file
Enabling the 'hidden' option for files in the %temp% directory
Connection attempt to an infection source
Sending a TCP request to an infection source
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a system process
Query of malicious DNS domain
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cmd cmstp evasive explorer fingerprint lolbin net_reactor obfuscated packed reconnaissance schtasks vbnet
Link:
https://www.filescan.io/uploads/67e91e9b6a150b67eec8af89/reports/f6dcce05-d578-4548-b9e0-16c3f82ba695/overview
Verdict:
Malicious
Labled as:
MSIL.Krypt.Generic
Link:
https://www.hybrid-analysis.com/sample/78976f38ca4b4e62ead97e1222faa8ce79c0f9a517ef57bdeae4dc3f2c834d1b
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/77db46b2-e4e6-4626-b7e6-535be4015d8f
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1652139
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Contains functionality to capture screen (.Net source)
Contains functionality to hide user accounts
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1652139 Sample: CheatDownloader.exe Startdate: 30/03/2025 Architecture: WINDOWS Score: 100 45 complete-fill.gl.at.ply.gg 2->45 47 ip-api.com 2->47 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus / Scanner detection for submitted sample 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 9 other signatures 2->59 8 CheatDownloader.exe 2 9 2->8         started        12 System.exe 5 2->12         started        14 System.exe 4 2->14         started        16 7 other processes 2->16 signatures3 process4 file5 39 C:\Users\user\AppData\Local\System.exe, PE32 8->39 dropped 41 C:\Users\user\...\System.exe:Zone.Identifier, ASCII 8->41 dropped 43 C:\Users\user\...\CheatDownloader.exe.log, ASCII 8->43 dropped 67 Contains functionality to hide user accounts 8->67 69 Uses schtasks.exe or at.exe to add and modify task schedules 8->69 71 Writes to foreign memory regions 8->71 77 2 other signatures 8->77 18 RegAsm.exe 15 7 8->18         started        23 cmd.exe 1 8->23         started        25 schtasks.exe 1 8->25         started        73 Antivirus detection for dropped file 12->73 75 Multi AV Scanner detection for dropped file 12->75 signatures6 process7 dnsIp8 49 complete-fill.gl.at.ply.gg 147.185.221.22, 25189, 49724, 49730 SALSGIVERUS United States 18->49 51 ip-api.com 208.95.112.1, 49725, 80 TUT-ASUS United States 18->51 33 C:\...\U2hhcnBEWC5kbGx7VlQgQ09OVFJPTCBSQVR9, PE32 18->33 dropped 35 U2hhcnBEWC5EaXJlY3...CBDT05UUk9MIFJBVH0=, PE32 18->35 dropped 37 U2hhcnBEWC5EWEdJLm...CBDT05UUk9MIFJBVH0=, PE32 18->37 dropped 61 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->61 63 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->63 65 Installs a global keyboard hook 18->65 27 conhost.exe 23->27         started        29 timeout.exe 1 23->29         started        31 conhost.exe 25->31         started        file9 signatures10 process11
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/78976f38ca4b4e62ead97e1222faa8ce79c0f9a517ef57bdeae4dc3f2c834d1b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78976f38ca4b4e62ead97e1222faa8ce79c0f9a517ef57bdeae4dc3f2c834d1b/
Threat name:
ByteCode-MSIL.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2025-03-30 10:36:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pclw6ogkjnhgf2wzpyjcf6vizz44b6nfc7xvpppk4tod6ledjunq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/250330-mnb29awzdz/
Behaviour
Delays execution with timeout.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
red_team_tool Win.Packed.Adwarex-9851111-0
YARA:
RDPWrap
Link:
https://app.threat.zone/submission/5ef58ff3-0b11-403f-a615-222428550d22
Unpacked files
SH256 hash:
78976f38ca4b4e62ead97e1222faa8ce79c0f9a517ef57bdeae4dc3f2c834d1b
MD5 hash:
2afd3b606ea6b1e9739fb9612b1f9031
SHA1 hash:
20f1200c08ab402837e3eb9ded0d64f47978ac12
Detections:
RDPWrap
Create hunting rule
Link:
https://www.unpac.me/results/3f44fb76-04a3-409d-8d21-e42b83b2a48b/
SH256 hash:
a0af255ea4b09a8cdb995b8c6fd1075e46f098e23c2351c974e6ded9b8b620cf
MD5 hash:
c52a44933d17d576d4c97b4cb0545841
SHA1 hash:
092696fdcc034910aa02c94a5c93f4e1e86e0c50
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3f44fb76-04a3-409d-8d21-e42b83b2a48b/
Parent samples :
78976f38ca4b4e62ead97e1222faa8ce79c0f9a517ef57bdeae4dc3f2c834d1b
818ef3d013069a7bacd3bf4d4a728ace9ea74ab518fb4adffcc0a23f57e4b585
50cb6b8d0f572cd355d682a3f3529854b98cc75e141e452c98bec0279ef1ace2
030c62f201281c0034102b3cab64490e51b0499a9b5fad498f1ded30b23dbf66
d65862ab1d8dfcba06ab6e1fc40d109d9c644cac4e02ef0c8fb30f96ec199b61
31e0765454785a12c86436331f67020b7390d16b9de42b954127799835eea36c
89a59fdc6d7e292adecc9602af1544e9d6c7fdb1f99f654a918d007422a93d14
78daa33cb739c0b1648f17599695cf0fc5ad0b1c7640d55d91e1d534a024c6f7
c8b2df4130ad422d0dab2be3798677609f0555f37d825cda228662d2112f3d6c
6597d0a917f2def35809cfcffd7c9098bc7e97eb62d35fb74486344208faf61a
a77fed3715f635883d0e54c30ab4d3ccad5afe0f845d27e5bff0f9410df4aaee
f879f50e21830b34b77fd94a33b6c395b9837bb701a7f5e4dad2e9d287af9e72
0a45180f1b3ef2e81e988e448cbf6eb1ddedcd864a7ecf46ac5a28aef8f2740b
6c2b4ca9e169f3d71f3fa2962b947c0f7b1e358e2e7ce6c9ee12778e0679f6b1
eb72d6dd2158ce9ad453f8ecfd5d6900cce588c196ae5806268cbaf3475848da
00b4241162e828f59e1a47467cdecd0c36f779e1e5b7c4930331c9104b6e1c55
SH256 hash:
bc0243134c93c55ea105d0e9c2a43b6030e973290d0a061cf3a61986a2268a88
MD5 hash:
d2edde626c241549eab636aa87fb5d38
SHA1 hash:
8d836febd477b3ec44cc37f4f0aecdaa1d7db788
Link:
https://www.unpac.me/results/3f44fb76-04a3-409d-8d21-e42b83b2a48b/
SH256 hash:
56f525e33494f4cd2a560a71cdf237303a3fb54a8fa44e1693eba35c9245c60a
MD5 hash:
07137e5cc4d5ecc95ca267c9dce042d4
SHA1 hash:
d82f5e3d718bc9172fcfe0e8c50cb20251762058
Link:
https://www.unpac.me/results/3f44fb76-04a3-409d-8d21-e42b83b2a48b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/78976f38ca4b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/78976f38ca4b4e62ead97e1222faa8ce79c0f9a517ef57bdeae4dc3f2c834d1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments