MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a8c0a42253b268618bf63ac631fe304c51014e38b8fdb2e2012cdb2b4a9861b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | a8c0a42253b268618bf63ac631fe304c51014e38b8fdb2e2012cdb2b4a9861b1 |
|---|---|
| SHA3-384 hash: | 7be3917198c22892017280feae5fd51afa85dad83ede6427df0ad4925b44b9b7db2e2d47831dc5fd769fba9f472d454a |
| SHA1 hash: | 50b7c5b76cf662d52896a79860a585cc18e8cc87 |
| MD5 hash: | 5e792b28f60d355d210294f26847089f |
| humanhash: | apart-delta-diet-three |
| File name: | rqualidadeADMAuditin.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 456'192 bytes |
| First seen: | 2023-05-10 18:05:28 UTC |
| Last seen: | 2023-05-11 18:19:46 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:I1XQakQK7FxbIBMPrIx2s627tbPdQDYn3DYj1A+I3Xn9zIPEjj1PmauqtHpp:uXQaYbBo2mBPdQDYzYj1fkndIPWT |
| Threatray | 2'802 similar samples on MalwareBazaar |
| TLSH | T137A4C18CA35B6449EB1EC7F7EB50F36527B36CAD29D18ACA01F73C6C2194A483F46611 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | e482b2b2a2b470c0 (1 x Formbook) |
| Reporter |  FXOLabs |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
291
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rqualidadeADMAuditin.exe
Verdict:
Malicious activity
Analysis date:
2023-05-10 18:06:58 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
floxif packed threat virus
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Swotter
Status:
Malicious
First seen:
2023-05-10 17:56:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
15 of 23 (65.22%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'792 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
7a8bc89b25fec00df031363c72c82a461699b54c111c7799f4f946cbdcf1cdb4
MD5 hash:
f51cb0d9a7d65b2095fb22076258f0c8
SHA1 hash:
37623195a91c7d991ba31e83755962f697bfc0ec
SH256 hash:
42add6e29dbec50e34211d7009907cd0293ed305dfb6977f54a807c265998301
MD5 hash:
078c400cd633b821fcfef502d62858bf
SHA1 hash:
d6967f951cf9b93d1b64d47754279731bd5d6964
SH256 hash:
a440b5929848e6071f401a94fc1a040f14094bf7701b151ff409aeaa60e05f95
MD5 hash:
909be53831182d523ccea3c428d59c4f
SHA1 hash:
8f8f99a97544638bdfc02b5f8054f833f46eccaa
SH256 hash:
a8c0a42253b268618bf63ac631fe304c51014e38b8fdb2e2012cdb2b4a9861b1
MD5 hash:
5e792b28f60d355d210294f26847089f
SHA1 hash:
50b7c5b76cf662d52896a79860a585cc18e8cc87
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | pe_imphash |
|---|
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.formbook. |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.