MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82c53ee74253581efe369c99373d6c978b3b9b799eb04de6c4eb59d2825e8ee2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82c53ee74253581efe369c99373d6c978b3b9b799eb04de6c4eb59d2825e8ee2
SHA3-384 hash: 5a1fb6919d8b2db5d4b11eec8c3143fcc0dd9cec1464dbd6dc9ef18538085943efabf1950b160f8a48e687ec850ee3d7
SHA1 hash: 5b1e2374d9b454b504584c89f599752adde69e91
MD5 hash: 96697eae976962a7ca0a3fb8f9befa13
humanhash: sixteen-eighteen-sweet-berlin
File name:82c53ee74253581efe369c99373d6c978b3b9b799eb04de6c4eb59d2825e8ee2
Download: download sample
Signature Formbook
Create hunting rule
File size:929'792 bytes
First seen:2020-11-12 14:03:38 UTC
Last seen:2024-07-24 18:13:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:V9bscvXsmIkiWA1d3aZRJJ1bGc11PDBrwJQohfuUeUCmF:NvXgkiWA1xa5ScDPkhL
Threatray 2'920 similar samples on MalwareBazaar
TLSH A0158C194A158F5FD93A0335802AC24043F58DD552A7EBE52DC0B8EF6EFA740E72B1DA
Reporter seifreed
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82c53ee74253581efe369c99373d6c978b3b9b799eb04de6c4eb59d2825e8ee2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:04:47 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qlct5z2cknmb57rwtsmtoplms6ftxg3zt2ye3zwe5nm5fas6r3ra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
29562212d731f51f5773e7996530971ccecfe84d6116bcbdbb3e41e6a2054b9a
Formbook
46c3ab59682596a8e030fb0bad3d31c59e502f68b9f3c112309edd82d27513c3
Formbook
5c1d2289de5b338620bb43ede89d6d7afcf86cc4d2b20db3a3f20e5579e925fe
Formbook
66c90051427f1fa801535028868a50ca3302392836ceaf8804c992e9f20dc372
Formbook
765c1e7486aedffd7021ae5f15c86e549c7b796a5025249781f9c8a6327f4037
Formbook
77707d4b60a7193c8c7e93d9c97dcd89513ef4ce1c8e19aa6780920c09e03c27
Formbook
787e10aed324cae24ab5136f95deb95efe8715a6bd7ced09028b2ee21d228a5e
Formbook
bbb95e154a42908b2bbb1797d8b6178343b7c084158183f628b5c4bf3fe5ac7d
Formbook
ebd88634ecfbdc7e88bca32a0b22fa35e24c9feb309799128f3d12d2cceac224
Formbook
fa1c05c7ea1e94e08982755ca1d13051a6cd334fa3e93aa98b5bcc2ebb910f59
Formbook
+ 2'910 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
82c53ee74253581efe369c99373d6c978b3b9b799eb04de6c4eb59d2825e8ee2
MD5 hash:
96697eae976962a7ca0a3fb8f9befa13
SHA1 hash:
5b1e2374d9b454b504584c89f599752adde69e91
Link:
https://www.unpac.me/results/39c0e7f2-12e9-415a-99b4-d2fb26c53345/
SH256 hash:
480d0b7091f8281f110534b1f60753220d116c97a1daee6eb0e85c06c3b4892f
MD5 hash:
ddb12a79c87bb30b9e12d7aa24dbec26
SHA1 hash:
1e37328e271fde07dea332bd3be528be359923a4
Link:
https://www.unpac.me/results/39c0e7f2-12e9-415a-99b4-d2fb26c53345/
SH256 hash:
be70a4e3d3237cb68ef0e75d82a0eb5b5a67f161eb4490314957632dfbe346c9
MD5 hash:
bd12eae6bc9472e084b57e2a83d8a1be
SHA1 hash:
6fe1b3be497c33a821361c04609523a69dc936ab
Link:
https://www.unpac.me/results/39c0e7f2-12e9-415a-99b4-d2fb26c53345/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/39c0e7f2-12e9-415a-99b4-d2fb26c53345/
SH256 hash:
3823ca0abd8ec63439f4b634afbedcf5cedc27e5841df5c782058d1ca6705541
MD5 hash:
cf30264b2cbf3ff81dc38a49d3af4ec2
SHA1 hash:
3b27e0fcfe070135001486b62091c5450853a9d5
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/39c0e7f2-12e9-415a-99b4-d2fb26c53345/
Parent samples :
5c1d2289de5b338620bb43ede89d6d7afcf86cc4d2b20db3a3f20e5579e925fe
106bdb692ef4339fa57776464369fd2cfcce28c4bb894ec4c46b895225be8846
82c53ee74253581efe369c99373d6c978b3b9b799eb04de6c4eb59d2825e8ee2
147e9dd9e7041f06f197d3a50fee8a9e029f545f3a4c443cbdb54c176f2d4bd5
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments