MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7d46610ae5744ada1e96b495b25ec11c8e2c3466e9065b5213420763c1dcb328. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 7d46610ae5744ada1e96b495b25ec11c8e2c3466e9065b5213420763c1dcb328 |
|---|---|
| SHA3-384 hash: | 72e11dfde943913583bfe6f336026a3c46b924b5a5cd286cf48c11bcfc2c0b4fef283244473ec737ad424d027309fde0 |
| SHA1 hash: | ae4d4cbeaedb3222638ce967c400bde8c442f966 |
| MD5 hash: | 0b6a1354e23e165708a6df601f3fa6a7 |
| humanhash: | fruit-neptune-black-princess |
| File name: | SecuriteInfo.com.Heuristic.HEUR.AGEN.1235746.28299.7106 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 670'208 bytes |
| First seen: | 2022-10-27 10:44:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:0HjL6Uh7kosU4D3YFrO02U8CS0Du4fl87Qj3fc43rmfTE5j56:mL2Q8IFKU8CSyi7c |
| TLSH | T102E4F189376275EFC857C472CD582D68FB21A566531FD207A01325ECAE4EA8BCF121F2 |
| TrID | 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 44c0a8b4a2ea7298 (9 x Formbook, 8 x SnakeKeylogger, 2 x AgentTesla) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Heuristic.HEUR.AGEN.1235746.28299.7106
Verdict:
Suspicious activity
Analysis date:
2022-10-27 10:46:25 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2022-10-27 10:21:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
23 of 40 (57.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:mvug rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
3e65bc757ea15389dccc6f91e9f11a4a13fb9caa0461c338681f354a64e6f43e
MD5 hash:
0feae74089a18a7d02bb95f862ea65d3
SHA1 hash:
d8eaccb9076d07ad7dfd4c84ab6c0d78bce342ea
Detections:
XLoader
win_formbook_auto
win_formbook_g0
SH256 hash:
85d82fb769dd6034ae6155f48735250fff196479556a9c4a6292597157b70181
MD5 hash:
0afeabf8f2b91d41e3c02eaeaeca3091
SHA1 hash:
8268abee57fe8caaf2db777de870903b9323b820
SH256 hash:
415e006f86635ad31391b425747748c6036d82cbf7467fb82a51aa1467175d5a
MD5 hash:
c5be3c2a1662e8ea682b711b003a1150
SHA1 hash:
ddc7e97d412f773d2b6ca53dc9287c1982bc4988
SH256 hash:
bc444c4ec803b91da7af06cb0eb233fe69f565067f89544bf750fc17a9ede6dd
MD5 hash:
b52058082749f08bbcb7036b0d4189e8
SHA1 hash:
90365baf6b18ff3139da00cd5caf30660643110e
SH256 hash:
248a7c4997aacb14ca032daf9668636839f921d0a3403f09a3b0ccfdc948cbf1
MD5 hash:
a7952169b04a2c6a39661aad59e79dcf
SHA1 hash:
88722f1a32c913307c0c6385b04478a79fabd12b
SH256 hash:
04b9fd09e289a1dd0961d16a6daf2148a4bc725b5284af952962f89dc15842a9
MD5 hash:
8fd26ff9ab9d65f0977bbe10ebff90e9
SHA1 hash:
548cd408284f5f50eb92c0955e1dfbd1bba5a1bb
SH256 hash:
7d46610ae5744ada1e96b495b25ec11c8e2c3466e9065b5213420763c1dcb328
MD5 hash:
0b6a1354e23e165708a6df601f3fa6a7
SHA1 hash:
ae4d4cbeaedb3222638ce967c400bde8c442f966
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.