MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92c4e3ddc8fc608b75a06797ef97660c81bd51ebd689419d4e80b54dfb53151f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92c4e3ddc8fc608b75a06797ef97660c81bd51ebd689419d4e80b54dfb53151f
SHA3-384 hash: 1aa4d23c9a52931d69d354a795a4d15b4556382bbacb0d7497919bb7ea26e19052c250375ad9729cc5fe50eb4dd3909a
SHA1 hash: be65ad7b1415c55e23116ec50cbc5cac8527ea9a
MD5 hash: c604a9b91c444213aa636ed1258f2da7
humanhash: quiet-earth-angel-mountain
File name:SecuriteInfo.com.W32.AIDetectNet.01.26355.2274
Download: download sample
Signature Formbook
Create hunting rule
File size:658'432 bytes
First seen:2022-04-20 12:40:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:Xdd9NKze8QUAigAuRDFz9Y5NmrNm2JI9njCTSRII0tilNxwozVcT7msNm:NMzJQ79YqkiDxCNxxci
TLSH T1F5E4E08C326072DFC867C476DEA85C78EAA5687B130B9603901715DDAA4D99BCF281F3
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/265135/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.26355.2274.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/625fff60482f2f41cad928c6/reports/8a22609c-6dc9-495f-9d4c-a599f748da35/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/42b60b01-6fe6-408d-a36a-881bb77f9c66
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/979594
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/92c4e3ddc8fc608b75a06797ef97660c81bd51ebd689419d4e80b54dfb53151f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-20 12:41:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=slcohxoi7rqiw5nam6l67f3gbsa32upl22eudhkoqc2u362tcupq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:g6k0 loader rat
Link:
https://tria.ge/reports/220420-pwq79agbdl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
9a305fac0d4e663a2368a87a881d23af1e10711b50dea2ffdf67745808756b63
MD5 hash:
b152a353d1b4e386efbd511473c8a760
SHA1 hash:
90313872e21f35b77493f0a516608fe31b3a54e6
Link:
https://www.unpac.me/results/caa604b5-8ee8-4029-823f-42979acf482a/
Parent samples :
884509a71f4c0a818866f49982a2f4a1146063f65cb05f4202bdf3eb422575b0
ea6374dcd41e742c65fda234c75ba33b7b190e452632185bd42476bec18a0e4a
9ed12486b8f2201f6e6783b44fb9fda3ca0866f746abe3269b8b9bb1edab45b2
SH256 hash:
e649e0d6c577aac4d57e7093d75b1dafcbf641f62110d177a9286749846ddc43
MD5 hash:
ecb7908b31c84e773559219d97756922
SHA1 hash:
ec70bff9e7e0f25b35e99a197a493b41b7553022
Link:
https://www.unpac.me/results/caa604b5-8ee8-4029-823f-42979acf482a/
SH256 hash:
82350cd98a76713b51c8f3a3f7cbcc2f84f34f4556e6235103b62b3f226e1e70
MD5 hash:
8e7c390b2cc6a55ca8ae43c47599251a
SHA1 hash:
b4c8b11ef3d60df1ef78ab2de42236d0da27ddd7
Link:
https://www.unpac.me/results/caa604b5-8ee8-4029-823f-42979acf482a/
SH256 hash:
2b85cd42600586bd5b817860af30ff7ff9bb482eecd2ee9f6aabf6748801314c
MD5 hash:
e1200a9ffcfe8d307b8a61c88559a7ec
SHA1 hash:
0d7ad43b9eb613b0b1fd23f1a9c747a5abf9f2e4
Link:
https://www.unpac.me/results/caa604b5-8ee8-4029-823f-42979acf482a/
SH256 hash:
92c4e3ddc8fc608b75a06797ef97660c81bd51ebd689419d4e80b54dfb53151f
MD5 hash:
c604a9b91c444213aa636ed1258f2da7
SHA1 hash:
be65ad7b1415c55e23116ec50cbc5cac8527ea9a
Link:
https://www.unpac.me/results/caa604b5-8ee8-4029-823f-42979acf482a/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/92c4e3ddc8fc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/92c4e3ddc8fc608b75a06797ef97660c81bd51ebd689419d4e80b54dfb53151f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/265135/

Comments