MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 96a59a7f3a3aed504052f94d5808bfc4f42054104c955e3fe244f0b0750b48c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 9
| SHA256 hash: | 96a59a7f3a3aed504052f94d5808bfc4f42054104c955e3fe244f0b0750b48c2 |
|---|---|
| SHA3-384 hash: | a9428c04ccce4100b262588937fa48e26f0dfc38274ff87ead9f4a6cf2edbef49561499adac9ef3c30166a9cca4c109b |
| SHA1 hash: | 399f7b93819e186bef159d0ba9118ecc35983f44 |
| MD5 hash: | 688a5cdda1ae1e75e3e84facfecf3fb4 |
| humanhash: | johnny-mississippi-cola-batman |
| File name: | 688a5cdda1ae1e75e3e84facfecf3fb4 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 873'912 bytes |
| First seen: | 2021-07-19 16:37:05 UTC |
| Last seen: | 2021-07-19 17:36:57 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger) |
| ssdeep | 24576:9+MOQW87bhQxtVUXYUdHu+2zjC3UuTuAn:9+rQQxtVUTdWXcuAn |
| Threatray | 6'564 similar samples on MalwareBazaar |
| TLSH | T10E0512704810ECE5DDAF033C14B71BC9BFB126B3C2848FFA5658525ED997B818A5A8F4 |
| Reporter |  zbetcheckin |
| Tags: | 32 exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
688a5cdda1ae1e75e3e84facfecf3fb4
Verdict:
Malicious activity
Analysis date:
2021-07-19 16:41:26 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Process Start Without DLL
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
xloader
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-07-19 11:27:38 UTC
AV detection:
17 of 27 (62.96%)
Threat level:
5/5
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 6'554 additional samples on MalwareBazaar
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader loader rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.partypacktv.net/a3ea/
Unpacked files
SH256 hash:
99ab48bfb5c9f20c77f992f60d04d788c8594f2882126c028c09fda3f3822c2b
MD5 hash:
3bc892c5d6eb85dc91a9b1f6df392b61
SHA1 hash:
bb8c44604692e4624981a11357d739c9a9dd93bc
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
b4f00ff877c6171d0013692c31dc5e4fd78bda6b0c0969cc435ef9bf4e95d626
MD5 hash:
32d647cb1b8fb4f688d76fd12ff27c50
SHA1 hash:
f58684fa2ade0995c467f5f7636caaafa7236c50
SH256 hash:
43c2d41c39d468511450386b0b75579d194e85b502f74cbdd5a664ac2df15477
MD5 hash:
316c300d66971b4b7c3513283a772cd3
SHA1 hash:
e119ac6590b8f48f84558031e8843b31e3e18d88
SH256 hash:
96a59a7f3a3aed504052f94d5808bfc4f42054104c955e3fe244f0b0750b48c2
MD5 hash:
688a5cdda1ae1e75e3e84facfecf3fb4
SHA1 hash:
399f7b93819e186bef159d0ba9118ecc35983f44
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.21
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing bas64 encoded gzip files |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://ebie.xyz/quotation.exe