MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 17

Intelligence 17 IOCs YARA 28 File information Comments 1

SHA256 hash:	ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040
SHA3-384 hash:	e54f7d567d6f41a996638b8895cc4ca5a8de56323ea99d53b9be8279f4f6d954aeb9be4095f30e1c018ea822af29b7fb
SHA1 hash:	26e8309b8b9eff1f38481a3c70f9a240d7192213
MD5 hash:	3935f15dafdd5edfca70895940dce681
humanhash:	ack-mirror-lake-speaker
File name:	3935f15dafdd5edfca70895940dce681
Download:	download sample
Signature	Formbook Create hunting rule
File size:	610'304 bytes
First seen:	2024-06-13 11:07:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:6+I/fIe8N6sqAtOuXeEjq1/9yPZNYlGtLefxwu:qIeWHOEjCoBNY4Liwu
TLSH	T14AD4D05963FA670BE6FEBB3664B029264F35BA606815F6AC9440C0ED9837F407521B33
TrID	29.1% (.SCR) Windows screen saver (13097/50/3) 23.4% (.EXE) Win64 Executable (generic) (10523/12/4) 14.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.0% (.EXE) Win32 Executable (generic) (4504/4/1) 4.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

375

Origin country :

Vendor Threat Intelligence

Malware family:

covid19

ID:

File name:

a99076b879e5fe8f5810cc6855527b5bf6f71658c44c9bad62b69f1bc0513b15.doc

Verdict:

Malicious activity

Analysis date:

2024-06-13 10:27:21 UTC

Tags:

cve-2017-0199 exploit cve-2017-11882 covid19 formbook xloader

Link:

https://app.any.run/tasks/7f6a4137-ca4e-4cd8-a770-42d64b921547

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.3976.27279.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=666ad38cda262547655f04c0win7simulatehigh_evasion

Tags:

Generic Swotter

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Verdict:

Malicious

Threat level:

10/10

Confidence:

89%

Tags:

packed

Link:

https://www.filescan.io/uploads/666ad3336b8dba248b406e9a/reports/d40a827f-4ea5-4294-b6e3-378fa198e69a/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e4d59a44-0843-4f8b-a684-a1520bdf44bd

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1456551

Signature

.NET source code references suspicious native API functions

AI detected suspicious sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040/

Threat name:

ByteCode-MSIL.Trojan.Snakelogger

Status:

Malicious

First seen:

2024-06-13 05:38:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vrqqm2mxyhwrs3odgeodfl6ckb7ml2l4iyscweuhdxhmrnky4baa._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/240613-m8jylawdkh/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e00af5da-62da-4795-86e8-b74330191af4

Unpacked files

SH256 hash:

6e093e11ecf0b624902be2e85d2c120e7cebd9dc3d882e11a658d2ef3083c5e9

MD5 hash:

7e29b899a573f0662c2c59588e62b523

SHA1 hash:

ee1d0cde2b34332668e65bc9d8715d3b7d06dfa0

Detections:

win_formbook_w0

win_formbook_g0

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

Parent samples :

efd15711fec91fec88b1b6c704932a4e6697b79f9ea12d2b766b53081c18d438
e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55
ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040

SH256 hash:

c1c823b721025cc3b1b2d1c9ca85af2b1acacbb17c17c326a4e97b55219a35ec

MD5 hash:

ae3c132f8ffbee8f9b7c7a21b1ebbec3

SHA1 hash:

97dc762487e30eb1a15f2ead39403a99b5c115f1

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

08e4a92fce304a1b6244188866bb51d1a3d700e1a5e4eb3ccec2f55d9435eae8

MD5 hash:

15ed9116ad74a6a09f04273eff311b6f

SHA1 hash:

f9f9c535fb3af44190f5280335c1a5ab06ed2b0e

Detections:

MALWARE_Win_DLInjector02

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b

MD5 hash:

fb1bc19121c4e190d83672bc71b493f0

SHA1 hash:

c3488b969ba578e28ee360be24b6416425a224a0

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

7fe69bea315eca8f46621fc0ea0b7d72c5bd769e2374122dff34af3c4f50de13

MD5 hash:

17e554bee446f1acbe95cbb8696967ee

SHA1 hash:

ee6f8ce97d62fe7dd1e82f64d66f1cb36c61ebcb

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

cf9cb3653a6b6d3c09cc73a879b7b22d4f370e67efc15896cf9d2c4f8cd50564

MD5 hash:

1891c41f335e140e142cc63408181369

SHA1 hash:

9912a84f0ee2480ce4139f22bf413ec1f786672b

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

f11dbef032dbc6fa1463ddbbd11b5eb9b2b277d74095af7eb318b8ee3eeec60e

MD5 hash:

7682b96adb6283bdb368a84a5841660e

SHA1 hash:

6c79d1435608e381eabdf4e569a02856a33479a8

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

13ea251e6c00f9967966790a4a7ca06c03fd547d5fe634e9960ba59f5ad68b50

MD5 hash:

e7a7c683da39372a2320ec4363620767

SHA1 hash:

2255e60d1d98e5f9823ee928544a4a810101448e

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

6bfc52239d31f5d4045e6854546ecfbeafa2da25c4cf16dd7a10d418fc86facd

MD5 hash:

7f7a7cc2afad2f5b3aa8f2242b51fea7

SHA1 hash:

1d44310ecbcaafe8c853f478c77243e00bb2ea2a

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

c6619e9638155cdc510b93ada303885c7fe599a1f89ca3f8f766ec99c0da59ce

MD5 hash:

f45945c26e04cf442df4c8dad7174c66

SHA1 hash:

152a3fe0330bf0814a8ab91f8c00845c3a19cfa2

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

SH256 hash:

ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040

MD5 hash:

3935f15dafdd5edfca70895940dce681

SHA1 hash:

26e8309b8b9eff1f38481a3c70f9a240d7192213

Link:

https://www.unpac.me/results/9657edc3-8050-4113-b9f8-ec674ec5dde4/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ac61066997c1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_Formbook Create hunting rule
Author:	@malgamy12

Rule name:	Windows_Trojan_Formbook_1112e116 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach

Rule name:	win_formbook_w0 Create hunting rule
Author:	@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

exe ac61066997c1ed196dc3311c32afc2507ec5e97c46242b12871dcec8b558e040

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2886444/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-06-13 11:07:41 UTC

url : hxxps://covid19help.top/sharo.scr