MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
SHA3-384 hash: 3d7035e5da09c3077932e2217f0ad05f6bc6f38ac8e87c4f01c61e187628d94de234db55e142462e3b3547be3699621b
SHA1 hash: 385651a4313fc4d8fa4369887f3d8ae99291057d
MD5 hash: a147b043c9bf220c3f7c30e5fab35414
humanhash: triple-table-sierra-louisiana
File name:a147b043c9bf220c3f7c30e5fab35414
Download: download sample
Signature Formbook
Create hunting rule
File size:603'136 bytes
First seen:2023-07-17 12:51:04 UTC
Last seen:2023-07-17 14:27:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:VyL9Vhs97dycOswymWm4bdJJFKeSDNjKkqTrQaSejL8Z:Iri7dLl1/bT7KeSDbqTrQaSejL8Z
Threatray 3'371 similar samples on MalwareBazaar
TLSH T1FDD4CF78503C87AFE767CBBAE424155323F013626AF2D38C8CB625AF3D75724A1549B2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
294
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a147b043c9bf220c3f7c30e5fab35414
Verdict:
No threats detected
Analysis date:
2023-07-17 12:51:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2e93d8ce-f835-44b9-85b3-4f325f5f2788

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/422303/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2182.4844.21219.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64b53973fd9e198dc114eabd/reports/98264f92-66af-41be-8213-489cdba6ab6a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cc11a171-b36a-4a9d-9432-8ddd5cf72d5e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1274408
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2023-07-17 10:10:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
17 of 25 (68.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ro2nx7vrf2tme73kjp43vamizqrreccrtygxyqv3jda5oudcy5wq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
10431b996eebfb109db1ffbf5f789d750cae0942f011591275f086e4cc946498
Formbook
13787d324c97537e5d73a1a3a0c72cdd35c2fac0c89b95589cc0fd275329a3a1
Formbook
2cd9e8fc5b73c35422b79574233937370a03f6714ba9e813da80ac2974b4cf91
Formbook
455479a2d31bd901fdff62e67ec93e40f80e5956384e93e5030132d4a490501f
Formbook
7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8
Formbook
de30e038eaa635585c23ec16221f9307e49152fe0d42d6f49a9435beb42f1f9f
Formbook
eb66ae0428282ee90ca78a2f0d37e322cc682bd9dccb9c7e50bf53da117fd0a4
Formbook
fabfc52b4f6d55fee942c164fed13e4d2b2654cafeff471a52e13c31384c19ce
Formbook
fed0556f87884c7d40eadd3e2f22d432da0b5854edda4404a936f5b66e00b534
Formbook
+ 3'361 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230717-p3284acf4w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Drops file in System32 directory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
341600e5fe8f53faf04eadc6390e471dc2444ab28691514af8b74c8b561d9a5b
MD5 hash:
67663152c1f736896ce8322eafc835ff
SHA1 hash:
4820664daf28d13d8c9ca922fd86d46c6eb7bff1
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/d3ed8cec-214e-4aa2-9633-a838a4195e0c/
Parent samples :
8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
fed8358d2eb6cd687bb6f6a88b4f8bc01bd5dcf355535532718a0f04f1eff674
c7616a546f8e22dd0a80b275f5991b6c6ab567d278be339904d6bff0c5c00a42
9e9af76a8585a7b99a59f042f64a711aaa8f9bfb68a4040ca522147470d6b6de
72d3a95a59ccd8220e04850fb54fdc48caa51c10739d96afa48ab5446303dc07
5348bcccead193b46acc11339b9c3ff05395753d536a0952641af34382e08604
20d45ab8062d59db6229e293a604f37e2760519894d07380288f0f8f5e2b5c95
adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c
a0c810baccbd3943748568d16e5b9cdf6b829364c8e4b21cda09c4f865b228f0
5e0519cad57279ab39f475c7ec22d2435a4a69f2378cf2254745e089f5c174fb
8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381
31fd5ab4ff38fd42399d4d90a19da71b94cd7ba47b0a97ce1bda37958ce97ef6
SH256 hash:
78eaae7f782e4b12d7d47f290ddaae74c19373393bb86673fb25633b7fcbc7c9
MD5 hash:
be26954f9951b84a519797424fc52ee1
SHA1 hash:
8228036eb552bf7679f37cbd463d3f911d29964e
Link:
https://www.unpac.me/results/d3ed8cec-214e-4aa2-9633-a838a4195e0c/
SH256 hash:
44bb496c5ac9b48a6ac683245837c4e176294bd07f2407ae7208f01533fc799f
MD5 hash:
8bc7899b2d0c4e3ccaf4de71afbcb747
SHA1 hash:
ceeaf5bbd853282d9a09a03ba20e92212ce11eff
Link:
https://www.unpac.me/results/d3ed8cec-214e-4aa2-9633-a838a4195e0c/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/d3ed8cec-214e-4aa2-9633-a838a4195e0c/
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/d3ed8cec-214e-4aa2-9633-a838a4195e0c/
SH256 hash:
8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
MD5 hash:
a147b043c9bf220c3f7c30e5fab35414
SHA1 hash:
385651a4313fc4d8fa4369887f3d8ae99291057d
Link:
https://www.unpac.me/results/d3ed8cec-214e-4aa2-9633-a838a4195e0c/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8bb4dbfeb12e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2684487/
Cape
Cape
https://www.capesandbox.com/analysis/422303/

Comments


Avatar
zbet commented on 2023-07-17 12:51:05 UTC

url : hxxp://103.57.130.167/Explorer/wininit.exe