MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048
SHA3-384 hash: 6d4f01b338fd6a04e0c04e3603b117646e1d982c16a07c1a9511dcc78609dc66c1a5fc6ee10dc27bd6d49410b04b28dc
SHA1 hash: 4e8070ce07b2e92ef9e3dfde6970f0ef43a95ac5
MD5 hash: ad805c8a19a06c66dad4e4e4a77ee305
humanhash: purple-golf-april-moon
File name:ad805c8a19a06c66dad4e4e4a77ee305
Download: download sample
Signature Formbook
Create hunting rule
File size:661'504 bytes
First seen:2023-09-12 15:36:58 UTC
Last seen:2023-09-12 17:43:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:voCC06+LYyVFYSfVjNSAfq8rcG82+33DHOBF+H2WN/77ICJvpyFfVG2nFsgIftfQ:7M+FYqVRSHQ8r3TAeZRXIWvpyF9tynt6
Threatray 46 similar samples on MalwareBazaar
TLSH T160E401243B9EBF59D67A93F65660910523B7B91A607BE3480CC3B1CE1036F418B91F6B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
315
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ad805c8a19a06c66dad4e4e4a77ee305
Verdict:
No threats detected
Analysis date:
2023-09-12 15:38:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/418c1a53-9ab9-4a17-8f7b-ebfb0f64eef4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448210/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Restart of the analyzed sample
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/650085a169c1cf3b6ab440b9/reports/c878bad1-03e2-453b-a326-246250a89871/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2654d067-cf48-4f7e-b3a4-8ba19d8e70f4
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1308567
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048/
Threat name:
ByteCode-MSIL.Ransomware.Loki
Create hunting rule
Status:
Malicious
First seen:
2023-09-12 15:37:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
15 of 22 (68.18%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vana2klff5odjf6zawysj7x4rhtrjh3bzb5sdgehfrg35dymabea._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
20e93d317f46bc7db6349a15c50362749b0b6cfde92b196b3eab03ccf1dc363b
Formbook
3899703b681fc2635f25de6e0f3fab60aaa03d46531b1423cd3c469059d62922
Formbook
75a5d5d46fa6c5178a43eea7c2d4d0bb66dd6879413318416dd70b4ef27faee8
Formbook
8ac567bfb4be359b1136e1236bbdbac3e160077a89952f967467a345a23c0047
Formbook
98bce22d33a7e23bf5a32739d01c10443509da758e81b57d26bcc1fcfeb3861f
Formbook
a4d5963e0d2770194c439a2fa07da2dda5eeceb8eb5bb5c1b106cff178f4e624
Formbook
ac254c8f30ac538efa1c6774d3b7e6a1b379af081c6cb15d36440e4913bc41c1
Formbook
bf3656cb6efbbc781ba5c11b9772fbf0fb0245ee08149ea66f880bdf5693907d
Formbook
c1a46fa04740b97fb8ffd1a24b00a770dd5ccb929a66583ed48a4ce75da7c175
Formbook
+ 36 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230912-s2ggsadg7s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
69753ecb17113e4abcbdb030e4912f7442a8e6f79cf1929c5a0f823ea65a5c6d
MD5 hash:
1a28ac90936cf703f2dc67434ef71668
SHA1 hash:
80d426a568d65467cee0d4aefa602ed7d95ec923
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
Parent samples :
a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048
becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789
SH256 hash:
52fc517cce669ae1bb30d77cddc0f8ed188c79e36ee31f03bccf69e2dac4f1e4
MD5 hash:
9dbed57e46235dd7337e4e8c64a8ad65
SHA1 hash:
bc4ee2d01a213a18851bffe83728c6edfd746298
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
9a63b62a1296933300f9cda87fefbdfc9f55ee908575a2130c641c9fd0c4f830
MD5 hash:
651ffbf7723d66c959851ec6c450fba2
SHA1 hash:
f7cf3587def824a298ae36da8ce82c62e2245f48
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
cee06cafe70438416c06dbebf5d7b7c7f968f0fe136b482309723d758c4230f9
MD5 hash:
623cf7cdfe064087af726c6b50bbde6d
SHA1 hash:
76e01da61b45cadd70ae97d03c83db9646f4d4a9
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
a93ab27d9bd9aa5b52288ff259e1dd2e8de2c873ee8fd5bbae64bca6f7624ce0
MD5 hash:
f2a2d829d920d375609a49544173df5a
SHA1 hash:
2af0e17de7935177d0a503ec980836fae9e17920
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
6576ab995115648b1b2f41b58e06db1273218b3c5ef333b925521c5049d28753
MD5 hash:
b4478a69374c42368d1ba75be97d031f
SHA1 hash:
ff5777c548e45b6fa687c16f059555261a98013b
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
24a7c1135d53ba92fd2445f9e48d8cd17aef1de935e92d7d91bbcc2b79a9f9d5
MD5 hash:
9b794b2375a3c1f738117510707b66d6
SHA1 hash:
e7c80add6203767d90c83eba21d7a30fda66e408
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
14dd866b0b55baf9b67ed5255f8d5999b9366a6981097a392103ba933d7452b1
MD5 hash:
104a06585040f658b4d7a96d85590193
SHA1 hash:
5b65e2537eab5e5c190a6911c935a20f93503bc9
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
2666ed7eaee03c3ec159998e4bd72f2d27e945d971a06d5f2515f9d6dd9d2624
MD5 hash:
771f71f23a29374cc8520bf046415da5
SHA1 hash:
2e495305a2b423b0f1db33d9ad102c8c3102f5cd
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
83fbbf8c28811f062ed86fe730a6652cdbd25496cbb5bb5d98f63b2c3c658cb4
MD5 hash:
3ac164540d74ab9f4f3ba992c4d7968e
SHA1 hash:
2b10842e7b550db45520250c3846e7b10014481b
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
d62cbd17d5e7ed36e1c2446d31a9dcab4933580343987a4843f2a8df2a41b248
MD5 hash:
7357dd45c59c412b083178b2bc168d91
SHA1 hash:
048276062c0d6b958d260a8a23823ad9e54e1efe
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
SH256 hash:
a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048
MD5 hash:
ad805c8a19a06c66dad4e4e4a77ee305
SHA1 hash:
4e8070ce07b2e92ef9e3dfde6970f0ef43a95ac5
Link:
https://www.unpac.me/results/4289cea3-418e-4247-b5b6-d7e0c0670f96/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2711319/
Cape
Cape
https://www.capesandbox.com/analysis/448210/

Comments


Avatar
zbet commented on 2023-09-12 15:36:59 UTC

url : hxxp://103.183.115.28/T129W/wininit.exe