MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 991c49a8668592960e79a55c4a5d6383e127f531489b6a5b72e01e54df6df9d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 14

Intelligence 14 IOCs YARA 21 File information Comments 1

SHA256 hash:	991c49a8668592960e79a55c4a5d6383e127f531489b6a5b72e01e54df6df9d7
SHA3-384 hash:	395f0d54e84fbf1b6f503d8775764b466b5433d5a0fce6584291ac4ccae674443a4db324545813012e584ab61b74f153
SHA1 hash:	a4054d677bd2b7a2ddf135ac0a1c0fc8cc364d88
MD5 hash:	3edf956e4ffc8c8c6834f6a83ead1948
humanhash:	march-lima-timing-fillet
File name:	3edf956e4ffc8c8c6834f6a83ead1948
Download:	download sample
Signature	Formbook Create hunting rule
File size:	679'424 bytes
First seen:	2024-01-18 09:36:22 UTC
Last seen:	2024-01-18 11:32:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:mzgxKS+xOn9Xf0loD2rpzj5y6dhpxkWqOqCkTfH:mzgxv+AnkgoquE
TLSH	T1E0E4CE04B7F80229FDF7077879B6A4695A36FE667D31C34E0004326E1B37B445A72B6A
TrID	35.4% (.EXE) Win64 Executable (generic) (10523/12/4) 22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.1% (.EXE) Win32 Executable (generic) (4505/5/1) 6.9% (.ICL) Windows Icons Library (generic) (2059/9) 6.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0e97978f1f0b5a1a (1 x Formbook, 1 x Loki)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

351

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

https://bazaar.abuse.ch/

Verdict:

Malicious activity

Analysis date:

2024-01-18 11:16:58 UTC

Tags:

formbook xloader

Link:

https://app.any.run/tasks/00df422a-8798-43cc-9c82-22f89816874d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/471473/

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.23260.32704.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Suspicious

Threat level:

5/10

Confidence:

78%

Tags:

packed

Link:

https://www.filescan.io/uploads/65a8f14194d1aebfb2a565e6/reports/a0529110-2b00-4125-9397-4c335dbd67b3/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/991c49a8668592960e79a55c4a5d6383e127f531489b6a5b72e01e54df6df9d7

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/39e75575-d41f-4299-90f8-d314b6c3414d

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1376627

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/991c49a8668592960e79a55c4a5d6383e127f531489b6a5b72e01e54df6df9d7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/991c49a8668592960e79a55c4a5d6383e127f531489b6a5b72e01e54df6df9d7/

Threat name:

ByteCode-MSIL.Trojan.SnakeKeyLogger

Status:

Malicious

First seen:

2024-01-18 09:37:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=teoetkdgqwjjmdtzuvoeuxldqpqsp5jrjcnwuw3s4apfjx3n7hlq._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/240118-llgdhsghdk/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Unpacked files

SH256 hash:

a3821f2cb8392da9802b30744c85a67046e66cf9c937baf68cba0e937692d219

MD5 hash:

490268b36629a67d3ebc0991ffbcd527

SHA1 hash:

7b180af5a83ca4b825ea06dc6ee66a36cd57edc1

Link:

https://www.unpac.me/results/c18c0ec5-5c50-463f-89d1-30c67f4c97b5/

SH256 hash:

0bea906eee3839949a88d4ccf1e688c770c4f496a3a8f44a532bff31bd13a224

MD5 hash:

f2dad39b379b1c8351c52200016f377c

SHA1 hash:

b21060761fc35a1508610deb5a6186b735e6a497

Link:

https://www.unpac.me/results/c18c0ec5-5c50-463f-89d1-30c67f4c97b5/

SH256 hash:

45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b

MD5 hash:

fb1bc19121c4e190d83672bc71b493f0

SHA1 hash:

c3488b969ba578e28ee360be24b6416425a224a0

Link:

https://www.unpac.me/results/c18c0ec5-5c50-463f-89d1-30c67f4c97b5/

SH256 hash:

c78c519139644d78ab352237b16b0c900a8692b931dd4feb6e2461e2001566f1

MD5 hash:

c2c8b9ab5bc41db9d8e546693d7cf68c

SHA1 hash:

0652c038cef92422580c2ba3de8f5b880bb94ab4

Link:

https://www.unpac.me/results/c18c0ec5-5c50-463f-89d1-30c67f4c97b5/

SH256 hash:

991c49a8668592960e79a55c4a5d6383e127f531489b6a5b72e01e54df6df9d7

MD5 hash:

3edf956e4ffc8c8c6834f6a83ead1948

SHA1 hash:

a4054d677bd2b7a2ddf135ac0a1c0fc8cc364d88

Link:

https://www.unpac.me/results/c18c0ec5-5c50-463f-89d1-30c67f4c97b5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/991c49a8668592960e79a55c4a5d6383e127f531489b6a5b72e01e54df6df9d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_Formbook Create hunting rule
Author:	@malgamy12

Rule name:	Windows_Trojan_Formbook_1112e116 Create hunting rule
Author:	Elastic Security

Rule name:	win_formbook_w0 Create hunting rule
Author:	@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

exe 991c49a8668592960e79a55c4a5d6383e127f531489b6a5b72e01e54df6df9d7

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2749291/

Cape

https://www.capesandbox.com/analysis/471473/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-01-18 09:36:24 UTC

url : hxxp://zsin2.ebnsina.top/_errorpages/ebilezx.exe