MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 81ba59b65af6a21be3cb743189516697ed3189d737aec85bfa3c4cfbffb9f376. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 81ba59b65af6a21be3cb743189516697ed3189d737aec85bfa3c4cfbffb9f376 |
|---|---|
| SHA3-384 hash: | d1bddf900394a1f20c3a3c12e357fe543ab2571915118e1b724add89192754d8e5533cac72d6229ad97e7e979fcf1dfe |
| SHA1 hash: | 79bfc54cb6b4f3960e6a04e9d2f8640ef1123808 |
| MD5 hash: | 1b39aac549e0639bc44b01c8024518c6 |
| humanhash: | september-fillet-mexico-potato |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.30819.32024 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'210'368 bytes |
| First seen: | 2022-11-23 04:27:43 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'654 x Formbook, 12'248 x SnakeKeylogger) |
| ssdeep | 12288:w/kh9GBCG/8tQc5aizZBerQi59qHJUsliET5a43JOfGH3+rbXkrwRi5A3RodOpsT:D7G//6Qk1oQCslPv5OU+ror0qdOp |
| TLSH | T1DD455B8B1F320D64CB4E3470088E077C9351FD6D6DB4DCB6EE346A6819A256B7E8236D |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 96969a9c9c981746 (2 x Formbook) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.30819.32024
Verdict:
Suspicious activity
Analysis date:
2022-11-23 04:31:31 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Tnega
Status:
Malicious
First seen:
2022-11-23 02:46:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
18 of 25 (72.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:vqmn rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook
Unpacked files
SH256 hash:
b87501c18746ea30cf08f00909b595c809954fc9f9c5b963f5622720e4d2a0f8
MD5 hash:
42aaa20b6b5b342a8c1215738a6838ef
SHA1 hash:
8c49ebb097a31334bb599fb32c5e6c24a57225e5
Detections:
XLoader
win_formbook_auto
win_formbook_g0
SH256 hash:
14f3e51b344fb045092d4b3f2586298a2a8b19f85d4f263e4239af1f80784c04
MD5 hash:
4651c876807200b81911aeb862817df0
SHA1 hash:
477cfcfcb59274b272bc34a537f0394923c73903
SH256 hash:
bccb350e0fc107d071e41e98c026fd9975f9f4cebdea55ee59660b61facb64b2
MD5 hash:
2873dd8b1e8e75038dc82f1bb69a3454
SHA1 hash:
ff467b2415d455fa9c2d18e7099c20a9102b65f5
SH256 hash:
e17215a47782e0905902f0acc157108a5099a18955c3af501c1c57fd5848a66d
MD5 hash:
e6d6a3247d49e56c7f8f28f42fb7f01f
SHA1 hash:
ff08942fbdc9e9004b0af944f6d4a89126c1ab10
SH256 hash:
d3564fe3774198dcf37d0b6182ae78722d9a4053afe1c55271c8459a44d56038
MD5 hash:
bd09cbf7f491da0038d98accaaf03bab
SHA1 hash:
446cabb1103236c28ca329634672129f307ffd29
SH256 hash:
b913021e8044bc468f252cf3e7de2774c0adf5741847a4b7141c3948e224ab18
MD5 hash:
99fb28cfa185106d4d013f6aeae4d080
SHA1 hash:
1ef35b7027c183ef0d88d6c86ee2fd510b213de0
SH256 hash:
81ba59b65af6a21be3cb743189516697ed3189d737aec85bfa3c4cfbffb9f376
MD5 hash:
1b39aac549e0639bc44b01c8024518c6
SHA1 hash:
79bfc54cb6b4f3960e6a04e9d2f8640ef1123808
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.