MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 939449a87190abf31d57482abe60fe159bd807abf7716daae0f0b3e217dba0d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 939449a87190abf31d57482abe60fe159bd807abf7716daae0f0b3e217dba0d1
SHA3-384 hash: df4e12bc7d1ab6dd2dfb7168f531289c165f53b4702c567195db9a9f409039162b91c540fa68988becebaadc5e31c14d
SHA1 hash: 03d40ea1afd659f0743d8bdbf4a693edbb71aca4
MD5 hash: 46b74acf332ee4641b195b8b3b2bf832
humanhash: hotel-butter-pennsylvania-yankee
File name:SecuriteInfo.com.Win32.PWSX-gen.31833.26622
Download: download sample
Signature Formbook
Create hunting rule
File size:942'080 bytes
First seen:2022-10-05 07:04:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:bPBR/4veW0TUoGmdwZIKo0BOdU8We1yWWhqSRmPhCyjeUB6dBS:b34veW05dwe50cf9xK1b
TLSH T1E215DF3507E6CA0BD5161678DCE3C3F0AFE85EA5A2B1C2474FE9BC6FF40B4A66611144
TrID 54.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
23.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
7.8% (.EXE) Win64 Executable (generic) (10523/12/4)
4.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.3% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 74f4c4d4d4d4d4d4 (6 x SnakeKeylogger, 5 x AgentTesla, 5 x Loki)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
260
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316739/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.31833.26622.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/633d2c9f0d3d21420cca91a7/reports/d9d2a2f0-9a6a-490b-a256-1acee4c617c9/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0c30aac3-fae2-4355-a9ac-09e6fa4dcab6
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1083901
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/939449a87190abf31d57482abe60fe159bd807abf7716daae0f0b3e217dba0d1/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-10-05 07:14:52 UTC
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=soketkdrscv7ghkxjavl4yh6cwn5qb5l65yw3kxa6cz6ef63udiq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:49id rat spyware stealer trojan
Link:
https://tria.ge/reports/221005-hwg61sdghq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1f7f1497-d54a-4fb2-a45c-7e8c873a154f
Unpacked files
SH256 hash:
4279d0e3070b162af592f0870eadff1321af76844b2e34b8ca319c01d3cc87fd
MD5 hash:
ef08ece35bbba382647be64b1573db39
SHA1 hash:
b07ba3a5207d556e8580cbf24dba3e28e7dfc659
Link:
https://www.unpac.me/results/94027715-ba47-416e-b26e-3232a810a5a4/
Parent samples :
c39d731b9c91c2a4cec5b7fc2c347f3f01fa10c7f2c661ca26d1bb93162c6c10
4e19209f5f5b17b97020866f1a01033869acdccb91c6118e7727691feb126563
73f74f1aec6f93a54aeb2da104556dfd49eeb747a4d88ef3cf9d2bed4ad41b70
d8140b4bf7e2a4ca69b47d15868cb181e29bc71bf2a28f4049c496f61b49eec1
SH256 hash:
d753bf3d257134324c0b5f929eb6468bd26022d08f6f3017625a922d822dd23d
MD5 hash:
8cd49dc450418d62a107eeb949bbc513
SHA1 hash:
db71521bee23f5266a2131d211777adc90dba257
Link:
https://www.unpac.me/results/94027715-ba47-416e-b26e-3232a810a5a4/
SH256 hash:
33e252442e4bad736594a4d42e9945510df219ea79de110387e85f2e6696cb3a
MD5 hash:
9b271977780e0c4fc6196f546b550280
SHA1 hash:
cbc8f9829f3818b00f40c0e2ff6a58dc16d9599f
Link:
https://www.unpac.me/results/94027715-ba47-416e-b26e-3232a810a5a4/
SH256 hash:
5fbdcb76c77563ed3d729fdca3396169c54443253001cf9b1b6b75a0f75cdcb4
MD5 hash:
629c31e71cfa6aab7a62bef45298816c
SHA1 hash:
932da9270d08d3b97ad1fb75e3d3180481f91096
Link:
https://www.unpac.me/results/94027715-ba47-416e-b26e-3232a810a5a4/
SH256 hash:
a1eef407d9ff6ce67f06c1ec1588fa834b12277fbe545e99127a186a8475f40c
MD5 hash:
aa99ae5de4dc5cbc794d5c2ab6513890
SHA1 hash:
252d8b4fcfab6ff3cf4b59a0106e106bd05141ee
Link:
https://www.unpac.me/results/94027715-ba47-416e-b26e-3232a810a5a4/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/94027715-ba47-416e-b26e-3232a810a5a4/
SH256 hash:
939449a87190abf31d57482abe60fe159bd807abf7716daae0f0b3e217dba0d1
MD5 hash:
46b74acf332ee4641b195b8b3b2bf832
SHA1 hash:
03d40ea1afd659f0743d8bdbf4a693edbb71aca4
Link:
https://www.unpac.me/results/94027715-ba47-416e-b26e-3232a810a5a4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/939449a87190abf31d57482abe60fe159bd807abf7716daae0f0b3e217dba0d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_imphash
Create hunting rule
Rule name:RansomwareTest8
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/316739/

Comments