MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c
SHA3-384 hash: 1fa99a3467099ec6996a525a0a2616e1857ef3000c870cde4b5686832ee4bc0e0ce41a731bd7861b5c0ffbd735529433
SHA1 hash: 4b4c8f3e21fd881168e7e3ecfe7d7d3be0bb583d
MD5 hash: dc451897edd5377f7cbae42beb23d410
humanhash: monkey-arkansas-asparagus-pennsylvania
File name:RFQ-1236819095.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:804'864 bytes
First seen:2023-05-05 11:36:13 UTC
Last seen:2023-05-09 07:52:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ti11KPDYMVm0aAUV/kziv0zb6fCTwqIV:APKPH4aUpKYiO
Threatray 2'869 similar samples on MalwareBazaar
TLSH T11805E02223B9BBA1ECF683FC6208E4006F746D6557B6E6E84DCAE0C95154F09F710B97
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
234
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ-1236819095.exe
Verdict:
Suspicious activity
Analysis date:
2023-05-05 11:45:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2b4c7dd4-68f3-4f5e-bf7f-ed92c594a36c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/386829/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66861757.6628.13327.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo jigsaw packed
Link:
https://www.filescan.io/uploads/6454ea5f03145f701ea2b51b/reports/c58246b7-7b01-44ab-9c9c-e9b350aa3353/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/450a7e0e-be33-44de-8d47-b6359bafe46b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1226841
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-05 05:10:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
19 of 36 (52.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sitaz35i5fz7jraogkvfmvwms6kloro3oc24pnaqu6ylcdcehrwa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
018c0b80b1914e2cbaf2de5b0e41a86e391fa88187fed25346adbec1eb5e3c45
Formbook
2c41ec55217c805b8a73085daa06089d01cd601d1bc16a0099be113222e0446b
Formbook
52582001ebe2883d2f5b20f0de69b42c27aef25ec30e09e1a294b9ae2c8131c3
Formbook
833a839bf412c22e06f2a3c0622e460df8fc5edbf55cdad09e7b76d5d73dacaa
Formbook
d1edcffd58ccef4c9709f027948bb28d09b1aee267cdd9b1271f7136b37ebd94
Formbook
d52990c3733f37b8d26a05d7db3864d5815bdfe6ecbaade840b81402e3cc29e7
Formbook
dc353de8e426e5a5934ca6cc0a3c164a6ac10599fc6341db12a9f7e7d3eb5f02
Formbook
dd208244eb1a5fd616173f4dd0ed419bcfc360c5c3237eb0510b4f97fa22b72d
Formbook
f508b66b3b6398f2a4d73ecfd057ab0804320d523e09feefbe59ee33b1124508
Formbook
f815d1ea14ef2734defc99e94b62ea6d0fd6a98f15a17c4476eef17b14f2587e
Formbook
+ 2'859 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230505-nq5m1sbh21/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
be1d91f54ac3942f111540df45f8e5707dd09cf6592c3a6518f1e21c7edb7d88
MD5 hash:
581f5b68a96fe615550382611224c96e
SHA1 hash:
6b7234fa3b6b5192846e14e2cfad82b2ee41ff5e
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/af66393a-7d1f-415b-8c24-bbe31585de48/
Parent samples :
92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c
2400be915c3981fa03b79f750cc5e37ae832d21e5e7f6bbd6753761286b036cb
8f3449b43eb5b5bc23330078ff8237c5d743a73519348f95b3c51d691f5663a3
fd775a8681200c469cfdbda94d5c9cde3454cb21a4a4783bad3aa647cab4378e
SH256 hash:
72b312931b9ecd4fbadc34e2d7a8808bcc27e007708490852a376c5df4690b38
MD5 hash:
db346564f5c72876cd6c9c6874f337e2
SHA1 hash:
feeb48062a5228bc706fb86fa81f5b34fe748475
Link:
https://www.unpac.me/results/af66393a-7d1f-415b-8c24-bbe31585de48/
SH256 hash:
280001013946838a651abbdee890fa4a4d49c382b7b5e78b7805caef036304e2
MD5 hash:
d4b6893a5512534104c6c7403be60897
SHA1 hash:
d4b51c3e4cafb3b146435a4e2e21bb5ddf15956d
Link:
https://www.unpac.me/results/af66393a-7d1f-415b-8c24-bbe31585de48/
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
Link:
https://www.unpac.me/results/af66393a-7d1f-415b-8c24-bbe31585de48/
SH256 hash:
1b5eb8bc740a4b3e6ade983395e83cb44b01eb0d867573d445cbf9ffc055389d
MD5 hash:
ee77519167f45aec2f4c00db88c1576d
SHA1 hash:
4bb0f1c088e62e1399a6758e9427b4ef3002f2f1
Link:
https://www.unpac.me/results/af66393a-7d1f-415b-8c24-bbe31585de48/
SH256 hash:
902a20594d4f62519c24c7fd4e5ad1b0dcb700629fc7dc0e884237371875c871
MD5 hash:
74fea28042845f57c9fc49173cfd0d81
SHA1 hash:
499206593676fde1ae60af58b9cd1f7b4fb405bb
Link:
https://www.unpac.me/results/af66393a-7d1f-415b-8c24-bbe31585de48/
SH256 hash:
92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c
MD5 hash:
dc451897edd5377f7cbae42beb23d410
SHA1 hash:
4b4c8f3e21fd881168e7e3ecfe7d7d3be0bb583d
Link:
https://www.unpac.me/results/af66393a-7d1f-415b-8c24-bbe31585de48/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/92260cefa8e9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/386829/

Comments