MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96cf18e2a423b74f89f810553f9b4ba3859bd2f71172facfc8911c6cf6221881. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96cf18e2a423b74f89f810553f9b4ba3859bd2f71172facfc8911c6cf6221881
SHA3-384 hash: 14f78ab561c07139cf8f0ba6a8ccc1423aadf0c0a10fff7f4c7c4cde09ecf683b63d14db553351c72929c771856737f1
SHA1 hash: d12adc35d2d94fd791aa0e4ef3ddcabc25b4e5ee
MD5 hash: fb3f2579d28b331f21a807ba134ea0fd
humanhash: tennis-leopard-july-indigo
File name:SecuriteInfo.com.Win32.RATX-gen.16890
Download: download sample
Signature Formbook
Create hunting rule
File size:1'150'976 bytes
First seen:2022-09-08 16:53:19 UTC
Last seen:2022-09-20 03:19:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:C4+NdVx1g5i3tsRdWsOV7MnVboiD3v848Wv/Qjou/4VA39GogX/BWF:CbnVsytqVboo0FWvIjv8Q9puBm
Threatray 14'624 similar samples on MalwareBazaar
TLSH T1F1352903619408A4D832D2B824ECC8734B6BAE65E53BC50D7FCDBC6BF6B3E5452D2661
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
dhash icon f6f9b5e6c486b3c9 (6 x Formbook, 6 x RemcosRAT, 4 x AgentTesla)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
330
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.RATX-gen.16890
Verdict:
Malicious activity
Analysis date:
2022-09-08 16:55:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/491e4643-9e1a-469c-a2da-3663e0c84c43

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/308838/
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.16890.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/631a1eb7a90642bcbbf08fca/reports/ea7b7fe1-2f98-4d5c-88f9-ded0aa9e405a/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fc102e14-4808-4796-bf0e-94f5235236b8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1067328
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/96cf18e2a423b74f89f810553f9b4ba3859bd2f71172facfc8911c6cf6221881/
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-09-08 16:54:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s3hrryveeo3u7cpycbkt7g2luoczxuxxcfzpvt6iseogz5rcdcaq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0e0dbd77f23d8c81b21d351b9a85d3fae401bb4b8ef5feec7634264671eafd1e
Formbook
401893d409c8453d7b0a4b7cd4ed000e61b32aa48a9e25a14f1d854fe0d86b7e
Formbook
4bbb39fcbea555b2ff359c3422f1058dcebd8e4cf0ae68d3b05f2198d57db9a8
Formbook
5b0b4e04eeb8e5fe001d7e0fca940bb1f8844fd4674bdf93a1864fa34b997477
Formbook
7f0d2570e95993562f659f45e635df91b3155a8c220bc1b859f1cf838bb66278
Formbook
83706cb8ae1132981fc4b5fbbd44e8433e5456d21fd0baf1c819998074b5fd25
Formbook
9139fdd15709f2c468d431d7557a6b3feb5d3bca897ade47452567070103be7e
Formbook
9c3860c6744d8b2718e1109e327795014997a81b0e21706a96242d0f8d52f55b
Formbook
ba9e6da19bce3c2fbfe97ab569379e144838a6f9245c4f4581865bc5bab3d503
Formbook
+ 14'614 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:an3u rat spyware stealer trojan
Link:
https://tria.ge/reports/220908-vejpqsfah4/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook
Unpacked files
SH256 hash:
785a50b20436cad83fc3530a20714cd0dac139dee61ee2a0d1b2d954f2e9ea97
MD5 hash:
1c154086c5ad5dbe28504936d1085b7a
SHA1 hash:
72f59ec087240242cb1a47f344ba5e0601db90d5
Detections:
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/baf8ca32-8343-477a-be2d-4448652a83a1/
SH256 hash:
668359ee74ad3a1b3a943c8c0a218e4fa86f4a48442107b5e76b444eb7370519
MD5 hash:
dd785e296e2600d9add132330202dc30
SHA1 hash:
3a54253df7df4e1be3d2f9bb741fe86e4c56f7b3
Link:
https://www.unpac.me/results/baf8ca32-8343-477a-be2d-4448652a83a1/
SH256 hash:
8b533ffaed24e0351e489b14aaac6960b731db189ce7ed0c0c02d4a546af8e63
MD5 hash:
dbc7be56e6e32349315170599c8b333f
SHA1 hash:
d8e5840e3574b87d435e55a65ac648e040871aee
Link:
https://www.unpac.me/results/baf8ca32-8343-477a-be2d-4448652a83a1/
SH256 hash:
29a0c6ac47880422fb49e60f77131391c3dc02374c771aa262bac44dab6ca1b3
MD5 hash:
fb033c6b224e0c2d80f46173ac3c276d
SHA1 hash:
8aea4c75a4c3eb5a16a5363d4dee4b8c9ceba551
Link:
https://www.unpac.me/results/baf8ca32-8343-477a-be2d-4448652a83a1/
SH256 hash:
e40a42ed8d05008f964015b359944442071ab6cf8663a59920de4b65c1b26278
MD5 hash:
d1a5ff9c9b9b7a4a467ac994fec34506
SHA1 hash:
4c61197d90130adda0b2caefaad58b3ec9905a65
Link:
https://www.unpac.me/results/baf8ca32-8343-477a-be2d-4448652a83a1/
SH256 hash:
9b4aee132a0228378d66a57fda3a2030952309ef74cf2db724ac916b04d8c034
MD5 hash:
93c6391d23c1aa1ed66fb13f82f2ee31
SHA1 hash:
220098c3047c32b51ae13a5cc1e9beeef3da6e18
Link:
https://www.unpac.me/results/baf8ca32-8343-477a-be2d-4448652a83a1/
SH256 hash:
96cf18e2a423b74f89f810553f9b4ba3859bd2f71172facfc8911c6cf6221881
MD5 hash:
fb3f2579d28b331f21a807ba134ea0fd
SHA1 hash:
d12adc35d2d94fd791aa0e4ef3ddcabc25b4e5ee
Link:
https://www.unpac.me/results/baf8ca32-8343-477a-be2d-4448652a83a1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/96cf18e2a423b74f89f810553f9b4ba3859bd2f71172facfc8911c6cf6221881

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/308838/

Comments