MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fb0c21777bc2f9b0dd0aa5519eebbe5ec9afa008e67edc2abec7e5c94957a36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fb0c21777bc2f9b0dd0aa5519eebbe5ec9afa008e67edc2abec7e5c94957a36
SHA3-384 hash: efe0b0f6c984fac01461c62c205f549edc5681b2414dcbb0676203a5e1069875f595acb0f0390bf81727ace0d9047395
SHA1 hash: 0c59ffad993ce69cf61515ba8eb49c83eedf3b3a
MD5 hash: aeb4846d8cc34834e9ae241d01f12279
humanhash: ink-minnesota-florida-cola
File name:aeb4846d8cc34834e9ae241d01f12279
Download: download sample
Signature Formbook
Create hunting rule
File size:1'005'056 bytes
First seen:2022-03-23 20:43:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:ZxRnaGXwSF6kufGoFZh1VXm+n2NHY4Zqg0AM7A:DlXwSTuGoFf72NHFqoM
Threatray 14'472 similar samples on MalwareBazaar
TLSH T1B325234C72B84673EC3F0FB9A5111280CF786D27ADA9D18D6CCCA4C65FA1B510B269E7
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
827
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/256894/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/623b86f40cd58dbd92e16706/reports/f261ba57-4ba8-4d0e-86fe-8d8dac1e7c27/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0a6f8d5a-dc35-4d7e-a812-502619c1fd88
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/963191
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7fb0c21777bc2f9b0dd0aa5519eebbe5ec9afa008e67edc2abec7e5c94957a36/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 20:44:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
17 of 25 (68.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
26b24cfe3b0bb84b26fc83ce689b74728ac61f32391772dcc76eab04cc7042b5
Formbook
3c010d88a118ba3cc666e05c6f8f82159ac38e5486b5ed60c65d870287b8cff6
Formbook
a9f8ff439d6cf51c60a5f9bba3653ea480fa72249562e11d6bc03bda8e672f5d
Formbook
b79d2d02fe777cfd64723ad9b3935b30c00cbc75614fcadbf867cce88df4a8fd
Formbook
c63cb761da677849b8382eb1d926569f00a04d57f2c789b63e7f2eb2e368a00c
Formbook
d0d6b8f342215efb1adba27088bb7f6dfe14dd3734612aecf1124b121c3a7cc6
Formbook
daac858e9ca5b0c8044385c2d94cbef17c41b0bd5c569ad7e03f0a51b4caab7a
Formbook
db4d5bd36f923fdd47daf48ace971f47e9764d27a2f88241f09c754c042efc28
Formbook
f136f4f9c59c4ff2582063222c6df106a3d1e3d7d9220ff73e3cb2ec487fe1db
Formbook
+ 14'462 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:a2rs rat spyware stealer trojan
Link:
https://tria.ge/reports/220323-zh6qwsfbfr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Unpacked files
SH256 hash:
a81499902dde3ef80dd11b6b2415ca6f6688593dc354b3eb4200049c1756693a
MD5 hash:
31d6231b6df4ad9ac0315fdeac1d5b7b
SHA1 hash:
2291233b6e557f4da173b6d4ff6cd33203927e32
Link:
https://www.unpac.me/results/8562acf2-afea-4576-b24a-c1dc085b1a1f/
SH256 hash:
5466e6e2bdb6c5cc3b1e33788e2937b1ba1b26757dd356cc31cfd48b99066d9d
MD5 hash:
e16ff83e77f8a758420c888a33a5aa6f
SHA1 hash:
5999b05c601d98c0b9f66b05c08e27ca1321730d
Link:
https://www.unpac.me/results/8562acf2-afea-4576-b24a-c1dc085b1a1f/
SH256 hash:
dc5c057b0ee1eb079cf189762aac69f0d86338ea18795dc4fbf7ed9b5a45c2eb
MD5 hash:
4103ed94f4747b30e166cf3c25416f47
SHA1 hash:
d553a67056e94f60d621ca42dcecd6d93f9ef1ad
Link:
https://www.unpac.me/results/8562acf2-afea-4576-b24a-c1dc085b1a1f/
SH256 hash:
de711978d83654dfd72b45187f161bfa2241f39277b55732bc35428962c40f16
MD5 hash:
5219170b15747107352cacbe41ea5a54
SHA1 hash:
6fb5234a6661bf18e37df2239af4eaf341533779
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/8562acf2-afea-4576-b24a-c1dc085b1a1f/
Parent samples :
a9f8ff439d6cf51c60a5f9bba3653ea480fa72249562e11d6bc03bda8e672f5d
0488a1801640896ea2e4922dcd03d47bea603db8b938aa2060bd529060ec37fd
d0d6b8f342215efb1adba27088bb7f6dfe14dd3734612aecf1124b121c3a7cc6
7fb0c21777bc2f9b0dd0aa5519eebbe5ec9afa008e67edc2abec7e5c94957a36
bce2bc3a55dfecfd388b134663893b70c3830b20a8afa395e36a28097e305943
cd0c02c985600efee1edc7dcca8808cdf06f3ac1d52427d39c2931d2472caa6a
SH256 hash:
7fb0c21777bc2f9b0dd0aa5519eebbe5ec9afa008e67edc2abec7e5c94957a36
MD5 hash:
aeb4846d8cc34834e9ae241d01f12279
SHA1 hash:
0c59ffad993ce69cf61515ba8eb49c83eedf3b3a
Link:
https://www.unpac.me/results/8562acf2-afea-4576-b24a-c1dc085b1a1f/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7fb0c21777bc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/7fb0c21777bc2f9b0dd0aa5519eebbe5ec9afa008e67edc2abec7e5c94957a36

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 7fb0c21777bc2f9b0dd0aa5519eebbe5ec9afa008e67edc2abec7e5c94957a36

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2112782/
  
URLhaus
https://urlhaus.abuse.ch/url/2112783/
Cape
Cape
https://www.capesandbox.com/analysis/256894/

Comments


Avatar
zbet commented on 2022-03-23 20:44:02 UTC

url : hxxp://107.173.192.140/77/vbc.exe