MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad958c67c1d8cc2dce3c9b7e3456f48cbff851107be42a7835a05d6e2f99faed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ad958c67c1d8cc2dce3c9b7e3456f48cbff851107be42a7835a05d6e2f99faed
SHA3-384 hash:	e8e8e2ccde105defaab70639aea59cc08f6c2db827505083b9fc6a5b8ef15be2b630d5b4eb7665d7425a1bb0c6a28af5
SHA1 hash:	e0ca82faa21b2c8cbf09172f07081059f55131a8
MD5 hash:	b0e7f08bf094306dd3619de1ccd07f87
humanhash:	comet-august-snake-april
File name:	Banka bilgilerinin doğrulanması,pdf.exe
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	745'472 bytes
First seen:	2023-12-14 13:46:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:t3FuHaAlhwBpBWFv4RD2/NiyzCWWq5XsUdWkjYH:iPl+RWFv492/ML3q+1KYH
TLSH	T146F4C0F535B5815BE5EE4EB4EF88557023F2696CB4C0A30D69F4720C4AF23A0198D7AE
TrID	53.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 22.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 7.7% (.EXE) Win64 Executable (generic) (10523/12/4) 4.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.3% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	849298a4a4a4e4e4 (3 x Formbook, 1 x AveMariaRAT, 1 x njrat)
Reporter	abuse_ch
Tags:	exe FormBook geo TUR

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

294

Origin country :

NL

Vendor Threat Intelligence

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Hybrid Analysis IL:Trojan.MSILMamut

Verdict:

Malicious

Labled as:

IL:Trojan.MSILMamut

Link:

https://www.hybrid-analysis.com/sample/ad958c67c1d8cc2dce3c9b7e3456f48cbff851107be42a7835a05d6e2f99faed

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious Packer

Malware family:

Malicious Packer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9414ea96-dcf9-4d94-b278-354c3cc187e1

Joe Sandbox FormBook, zgRAT

Result

Threat name:

FormBook, zgRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1362139

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/ad958c67c1d8cc2dce3c9b7e3456f48cbff851107be42a7835a05d6e2f99faed

CERT.PL MWDB xloader

Detection:

xloader

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/ad958c67c1d8cc2dce3c9b7e3456f48cbff851107be42a7835a05d6e2f99faed/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-05-20 09:17:14 UTC

File Type:

PE (.Net Exe)

Extracted files:

21

AV detection:

22 of 37 (59.46%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vwkyyz6b3dgc3tr4tn7divxurs77quiqppscu6bvubow4l4z7lwq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Hatching Triage zgrat

Result

Malware family:

zgrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:zgrat rat

Link:

https://tria.ge/reports/231214-q3h1wsfec2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Detect ZGRat V1

ZGRat

UnpacMe XLoader win_formbook_w0 win_formbook_auto win_formbook_g0 Formbook MALWARE_Win_zgRAT

Unpacked files

SH256 hash:

4c18cf4c183cbdf3e56a6ff066006412afa4e3af052bda02f025e1c8437dc616

MD5 hash:

d7c3ab07a464bc75337aae824f5292f0

SHA1 hash:

4c8f3737b109f8cfda501afcfa61492d4e58f639

Detections:

XLoader

Alert

Create hunting rule

win_formbook_w0

Alert

Create hunting rule

win_formbook_auto

Alert

Create hunting rule

win_formbook_g0

Alert

Create hunting rule

Formbook

Alert

Create hunting rule

Link:

https://www.unpac.me/results/a3ca3e3a-3b98-4d70-8273-f69b57bab66d/

Parent samples :

181b33c4cba7fc9aad25283ed5fce1f171f8fb64af1591bfe5c38285a7091956
b67c56bafb316958f7f38463825bbc1daf462fe91a871cd37bdabdfd3c1630b5
4ff209aea9caf232f64a0a1670504bc6f37d079fa66dbe303439a93e00c3cdc6
ad958c67c1d8cc2dce3c9b7e3456f48cbff851107be42a7835a05d6e2f99faed

SH256 hash:

187700e1704dbfc438d8e0e47ed6d15b4d4e0bffa638216eddfcc51ec0a2d617

MD5 hash:

3a0fe46229da323fff01b7e23b6c484b

SHA1 hash:

f795f8ad1a08e3ab98bc3db2b51683fdfba99f66

Link:

https://www.unpac.me/results/a3ca3e3a-3b98-4d70-8273-f69b57bab66d/

SH256 hash:

179b5efd354048634e59b56299b541fc55d6b8b84b77b195fb0d7379a37abcfb

MD5 hash:

fd6edbb0b3e5a4ce8c4e3f8980a1cf27

SHA1 hash:

e46dadeb251efd930734475116adf450fdbeee54

Detections:

MALWARE_Win_zgRAT

Alert

Create hunting rule

Link:

https://www.unpac.me/results/a3ca3e3a-3b98-4d70-8273-f69b57bab66d/

SH256 hash:

dd7d565b49488abb8729db8fb22ade4664385efa456417dd1f61ae65aa5b14bd

MD5 hash:

90bf44a58ac44f9cb8c05fc5c23b902d

SHA1 hash:

d57fd55c981606efcbc30617a6a43f3110d9ae16

Link:

https://www.unpac.me/results/a3ca3e3a-3b98-4d70-8273-f69b57bab66d/

SH256 hash:

ad958c67c1d8cc2dce3c9b7e3456f48cbff851107be42a7835a05d6e2f99faed

MD5 hash:

b0e7f08bf094306dd3619de1ccd07f87

SHA1 hash:

e0ca82faa21b2c8cbf09172f07081059f55131a8

Link:

https://www.unpac.me/results/a3ca3e3a-3b98-4d70-8273-f69b57bab66d/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.87

Link:

https://yomi.yoroi.company/submissions/ad958c67c1d8cc2dce3c9b7e3456f48cbff851107be42a7835a05d6e2f99faed