MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e1624df0ec310b2766bd7a9a98f05ef1ed576f0f7e0699aee3ecc35ddb03c12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	7e1624df0ec310b2766bd7a9a98f05ef1ed576f0f7e0699aee3ecc35ddb03c12
SHA3-384 hash:	99586aafc4e1330b33e9aa2ceedad1e1ac14f3a2ec57267248edad432dee0242c0aa0c39c6edce5395ea159e9f596be7
SHA1 hash:	6cf6a99cea366fab81b6ca4ed0a9bd0ffd1fbe8f
MD5 hash:	78d2e320fcbf93af2ac712d37be34338
humanhash:	yankee-pip-oven-jig
File name:	BTC inc..exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	79'872 bytes
First seen:	2022-02-08 17:10:48 UTC
Last seen:	2022-02-08 18:56:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'455 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	1536:cQGa+erDLKGTkSdg5i498DYwz1gvUEoDgakcGSqDsecmUMdpNRQXr6tiz:cQOmHKR8DHz1KloDjpUhcspzQXr6Yz
Threatray	38 similar samples on MalwareBazaar
TLSH	T1E3737B4573932761C2A954B1C1E7452507F2E78B3633D78E3E8C16CA1F237E58E8AB98
File icon (PE):
dhash icon	f0e8cc9ececce8f0 (1 x Formbook)
Reporter	adm1n_usa32
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

BTC inc.exe

Verdict:

Malicious activity

Analysis date:

2022-02-08 17:08:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9c28926b-f607-4e40-b331-3d6b37b2165a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/238396/

Detection(s):

SecuriteInfo.com.Variant.Lazy.116177.12646.19080.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a file

Launching a process

Searching for synchronization primitives

Running batch commands

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

Sending an HTTP GET request

Creating a window

Unauthorized injection to a recently created process

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm obfuscated packed

Link:

https://www.filescan.io/uploads/6202a49d4077c8b9a0225da6/reports/a69e3da2-e30a-4e86-975c-9ca2ac3477c8/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8621e70a-5eab-4e86-bd37-f6297ba13b04

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/936221

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7e1624df0ec310b2766bd7a9a98f05ef1ed576f0f7e0699aee3ecc35ddb03c12/

Threat name:

ByteCode-MSIL.Trojan.Lazy

Status:

Malicious

First seen:

2022-02-08 17:11:09 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 27 (74.07%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pylcjxyoymile5tl26u2tdyf54pnk5xq67qgtgxoh3gdlxnqhqja._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

10/10

Tags:

vmprotect

Link:

https://tria.ge/reports/220208-vp9nxabef6/

Behaviour

Checks processor information in registry

Creates scheduled task(s)

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Drops file in System32 directory

Checks computer location settings

Loads dropped DLL

Downloads MZ/PE file

Executes dropped EXE

VMProtect packed file

Suspicious use of NtCreateProcessExOtherParentProcess

Unpacked files

SH256 hash:

7e1624df0ec310b2766bd7a9a98f05ef1ed576f0f7e0699aee3ecc35ddb03c12

MD5 hash:

78d2e320fcbf93af2ac712d37be34338

SHA1 hash:

6cf6a99cea366fab81b6ca4ed0a9bd0ffd1fbe8f

Link:

https://www.unpac.me/results/87ac359c-5d6d-4da7-bc34-98197d8bd931/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_PE_Discord_Attachment_Oct21_1 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:	Internal Research