MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa6cd6162fb3dcd29b8b8d404c59e5cc6ea032f967af8aeb155e556ab872fc1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa6cd6162fb3dcd29b8b8d404c59e5cc6ea032f967af8aeb155e556ab872fc1e
SHA3-384 hash: 0c6ec5acba9edac94ddc1f0af9d0d022599cd46ff94cf03c3ba6e05b78b9fbca2f32f56267cc768ba835977ef43a4632
SHA1 hash: 742ff4aca7334e2b2ba7a9fe2ead19e0a1a000ed
MD5 hash: 723c53e333a5718f2d30982d7599d1d5
humanhash: mountain-triple-paris-helium
File name:CtTZm1DHG4A9nbE.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:650'752 bytes
First seen:2023-12-04 09:07:58 UTC
Last seen:2023-12-04 10:33:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'737 x AgentTesla, 19'596 x Formbook, 12'240 x SnakeKeylogger)
ssdeep 12288:Z45+po25hAMD6e6lXBwsroaalCNO/AftdDbVglOR6lh+evDal:k+pJH90QsraCNOGSOAlhbvDa
Threatray 261 similar samples on MalwareBazaar
TLSH T1A7D4237AB2D59A62F73F87FF76C9C490D37AE5032230D62E680291C607A5F0D6681B47
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 23ccccfc3c6c2c17 (12 x Formbook, 8 x AgentTesla, 5 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
307
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/462276/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.59820.18944.31780.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/656d97007485e5b1ecc5cb40/reports/e598d848-275f-4209-b3ee-edd42ca02e6f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/aa6cd6162fb3dcd29b8b8d404c59e5cc6ea032f967af8aeb155e556ab872fc1e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b902c84f-fd60-4d59-bfa1-3a45edbceecd
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1352975
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1352975 Sample: CtTZm1DHG4A9nbE.exe Startdate: 04/12/2023 Architecture: WINDOWS Score: 100 28 www.skylinetradecraft.xyz 2->28 30 www.westcoastmedia.marketing 2->30 32 16 other IPs or domains 2->32 40 Multi AV Scanner detection for domain / URL 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 48 6 other signatures 2->48 10 CtTZm1DHG4A9nbE.exe 3 2->10         started        signatures3 46 Performs DNS queries to domains with low reputation 28->46 process4 signatures5 58 Injects a PE file into a foreign processes 10->58 13 CtTZm1DHG4A9nbE.exe 10->13         started        16 CtTZm1DHG4A9nbE.exe 10->16         started        process6 signatures7 60 Maps a DLL or memory area into another process 13->60 18 qgtjhCYVBEKJreibMqUHyctSyHx.exe 13->18 injected process8 process9 20 systray.exe 13 18->20         started        signatures10 50 Tries to steal Mail credentials (via file / registry access) 20->50 52 Tries to harvest and steal browser information (history, passwords, etc) 20->52 54 Writes to foreign memory regions 20->54 56 3 other signatures 20->56 23 qgtjhCYVBEKJreibMqUHyctSyHx.exe 20->23 injected 26 firefox.exe 20->26         started        process11 dnsIp12 34 www.skylinetradecraft.xyz 69.57.161.215, 49733, 49734, 49735 FORTRESSITXUS United States 23->34 36 cname.tl-shops.click 185.203.72.4, 49749, 49750, 49751 VARITI-INT-ASCH Switzerland 23->36 38 8 other IPs or domains 23->38
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/aa6cd6162fb3dcd29b8b8d404c59e5cc6ea032f967af8aeb155e556ab872fc1e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa6cd6162fb3dcd29b8b8d404c59e5cc6ea032f967af8aeb155e556ab872fc1e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-04 09:09:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjwnmfrpwponfg4lrvaeywpfzrxkamxzm6xyv2yvlzkwvods7qpa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
01c08f7f6e5e5b8056c649e8b0b5bcdcb47835323bc393bc2582f5cf720ba437
Formbook
11d9bfab2d9c7344ef52970bd53f3dae040d3821f8ff0a03ba1f3d92593f7717
Formbook
40d0636d3ec2287a07009b05a8bd7d4143b6cbb35eba9c23d9cfd239c8f9c575
Formbook
6de3ca2658af9f752d06492509b21dbe3862fc018270f56d5a2894cb6e5a1e7a
Formbook
b5aae370f7b29f63c9dd24562d16b7a77bda593fbe4d2f316046cdb444e343f6
Formbook
b960e59e160d3b049843908bcfb05c00326a252a574de70d2126ddaa8f48a962
Formbook
ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8
Formbook
+ 251 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/231204-k3wn4aab2w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c1af4b9b19dba2fbd7ae8be42b13c095a1508b20d543d796f11864980d1eabe7
MD5 hash:
b0c56edecf2639875624c20b2a752053
SHA1 hash:
e347411b8a692083a8069d9e14f11aa8729ceec0
Link:
https://www.unpac.me/results/31c186b9-0ee1-49c1-b933-8001d7634991/
SH256 hash:
527d2ace76a2744a4b3b62de9ab4ff25fb6e5c5ab986ac5f7266afa43b0860c2
MD5 hash:
968afd2c9a2c48adc21498caebcfc692
SHA1 hash:
af787a1b21f3422099475192fffc3e2c180adea6
Link:
https://www.unpac.me/results/31c186b9-0ee1-49c1-b933-8001d7634991/
SH256 hash:
43b2fc14985d739e6f7181c2f6723063d08406049de2ee05d442ddf8542e45a1
MD5 hash:
c45dd34cf47c233b1a5261dc4974a6c3
SHA1 hash:
99df2482760541fc9bd912535feb04dbf72cc756
Link:
https://www.unpac.me/results/31c186b9-0ee1-49c1-b933-8001d7634991/
SH256 hash:
df99b8c34bac84fdb5cfa15f115ea9db4cbbd3a41d94a4108240acde517c2260
MD5 hash:
69aa5f738e730e01be47a3c3d798d0c2
SHA1 hash:
92866e4e86d74ac022cf3c340bc71373b4a26724
Link:
https://www.unpac.me/results/31c186b9-0ee1-49c1-b933-8001d7634991/
SH256 hash:
674e29cf9eadc8d71fa0e24c1706f72b38843efb1b2d92822d3a387d0305877e
MD5 hash:
909bcee620bf0a42f8641f6b0af0c9b9
SHA1 hash:
8faf62c80f69e94ba4aa38e722666ccd626f15dc
Link:
https://www.unpac.me/results/31c186b9-0ee1-49c1-b933-8001d7634991/
SH256 hash:
aa6cd6162fb3dcd29b8b8d404c59e5cc6ea032f967af8aeb155e556ab872fc1e
MD5 hash:
723c53e333a5718f2d30982d7599d1d5
SHA1 hash:
742ff4aca7334e2b2ba7a9fe2ead19e0a1a000ed
Link:
https://www.unpac.me/results/31c186b9-0ee1-49c1-b933-8001d7634991/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aa6cd6162fb3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa6cd6162fb3dcd29b8b8d404c59e5cc6ea032f967af8aeb155e556ab872fc1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe aa6cd6162fb3dcd29b8b8d404c59e5cc6ea032f967af8aeb155e556ab872fc1e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/462276/

Comments