MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af9d760cb99f11e3c067147897227817455fb9cea10e5db1b08dd582ca795a5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af9d760cb99f11e3c067147897227817455fb9cea10e5db1b08dd582ca795a5e
SHA3-384 hash: 3fd77955982dde79e1c7bb0912c0aa513c3b2c713428f00a90488922b8ce1d70b71829fbd7273ec1cfdae5da7c00d9ea
SHA1 hash: 589fe41ad8f73b166e3618f0cf79a7811e171986
MD5 hash: c522a931b72f98308a8384a010ecd6dc
humanhash: nineteen-bakerloo-cup-texas
File name:SecuriteInfo.com.W32.AIDetectNet.01.20685.18418
Download: download sample
Signature Formbook
Create hunting rule
File size:558'592 bytes
First seen:2022-05-23 11:50:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:A6+Z9x2Tdc5agaoxKVrezBswp1DACelI/iZ011:AbPYTdcvQVCzOCvqZ
Threatray 15'738 similar samples on MalwareBazaar
TLSH T13CC423259EB4EB79CDF9D7B160B8035602A496B9E0D0F9DF4E0144993223B89C8D37E7
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetectNet.01.20685.18418
Verdict:
Malicious activity
Analysis date:
2022-05-24 02:42:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5a87ae1b-7b93-46ba-a09f-07d3c9a14785

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/273622/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/628b754c6eb3ff326323aab2/reports/7da6c676-7de1-4b84-a109-39453325395e/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8122ff79-2349-41da-b60a-3add22aa6826
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/999716
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/af9d760cb99f11e3c067147897227817455fb9cea10e5db1b08dd582ca795a5e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-23 10:27:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6oxmdfzt4i6hqdhcr4joityc5cv7ooouehf3mnqrxkyfstzljpa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
181b33c4cba7fc9aad25283ed5fce1f171f8fb64af1591bfe5c38285a7091956
Formbook
58cc4fb92acd7f0115ee88119f1e131a0e79980a7fe547ffbf0fd777f0cb90e6
Formbook
5a6ac40a3c393c4a3feff2030b34b6493215f0e855588f585fdb768529a3deae
Formbook
5f5195f363ef21135a5b5298c2a3576bd03125eec094d769b25296eb0a2605b9
Formbook
67e2366e87044cbdeefa32770db63e9592c7e637d4c62c678f894eeba419bd26
Formbook
b02d4d23621c721c923d3772118c91d76cbe9c268895aef2d1933ba3fed08a62
Formbook
b67c56bafb316958f7f38463825bbc1daf462fe91a871cd37bdabdfd3c1630b5
Formbook
bef0d9edea1dd55695f0490efa9a9dfaefeff5154dc56f407391781dc7e0ed4c
Formbook
+ 15'728 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:s4ig loader rat
Link:
https://tria.ge/reports/220523-nz5z5sdbf3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
4da31f0afe8c9115ce2e145713b21d2c23653efb344f501b42694d1518c2f4b8
MD5 hash:
76d7e1ef134b965bbef29d037ca16d39
SHA1 hash:
03cd973bccbe4fa271ae35c5c653a4e351abf41b
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/702b5400-c353-4616-a580-d050eaca79c1/
Parent samples :
5a6ac40a3c393c4a3feff2030b34b6493215f0e855588f585fdb768529a3deae
58cc4fb92acd7f0115ee88119f1e131a0e79980a7fe547ffbf0fd777f0cb90e6
af9d760cb99f11e3c067147897227817455fb9cea10e5db1b08dd582ca795a5e
SH256 hash:
fdd10fb67e6276b3d848c92d4686f56b2ecbea1d629795a241ca6306a2f62d55
MD5 hash:
f20fd214bbda1a459a3eb415eec86017
SHA1 hash:
c658f61e4f308a69a4509649439814166c655e84
Link:
https://www.unpac.me/results/702b5400-c353-4616-a580-d050eaca79c1/
SH256 hash:
82daf948a8f55468f5ced4979ed8f11d8bfcafe7f8a02be2b94109880799174a
MD5 hash:
32306cffec93e4fb394d5b1f706043c5
SHA1 hash:
5921d1e594f125c7a9faeecf399d9480414e96c9
Link:
https://www.unpac.me/results/702b5400-c353-4616-a580-d050eaca79c1/
SH256 hash:
bca6a980cd22133a4bb70383cfa9f4a9e8490bb813a99017930c48439b3b9556
MD5 hash:
4567082a7ee51362fb6c02ba64ae8cf7
SHA1 hash:
51c3f50a14b5c96d3be6bb1665d9b50b9000dc5a
Link:
https://www.unpac.me/results/702b5400-c353-4616-a580-d050eaca79c1/
SH256 hash:
36605569ac0c2b34e5a5935bcaaeddc9bd1c5887ea36ee2887f464a7e5f5fadd
MD5 hash:
f92869787f7433cb53a83106e91be474
SHA1 hash:
487e1ae1bbf574bc9e526c0e6f2c9028fb2f60cb
Link:
https://www.unpac.me/results/702b5400-c353-4616-a580-d050eaca79c1/
SH256 hash:
af9d760cb99f11e3c067147897227817455fb9cea10e5db1b08dd582ca795a5e
MD5 hash:
c522a931b72f98308a8384a010ecd6dc
SHA1 hash:
589fe41ad8f73b166e3618f0cf79a7811e171986
Link:
https://www.unpac.me/results/702b5400-c353-4616-a580-d050eaca79c1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/af9d760cb99f11e3c067147897227817455fb9cea10e5db1b08dd582ca795a5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/273622/

Comments