MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 15

Intelligence 15 IOCs YARA 5 File information Comments

SHA256 hash:	b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059
SHA3-384 hash:	9d48133d1632af84b59314d3c8366771e99dc1332aaa4df9fbce019517a4046f14decee7249b943e295b9528675a8d9f
SHA1 hash:	961b5b88e48bcc5f66c6cf7f8843edda7b0e3a7a
MD5 hash:	4cead61470ed32fdfe7ebb7e1429b9d1
humanhash:	lactose-seventeen-fix-fix
File name:	SecuriteInfo.com.Trojan-Downloader.Autoit.gen.22126.2277
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'225'728 bytes
First seen:	2024-09-12 07:27:20 UTC
Last seen:	2024-09-12 12:23:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	bbac62fd99326ea68ec5a33b36925dd1 (46 x AgentTesla, 38 x njrat, 27 x Formbook)
ssdeep	24576:Z4lavt0LkLL9IMixoEgea2yhAe6du5drfLwtiaaukS91q9MmCS:okwkn9IMHea2dndu/8tLHkkaPCS
Threatray	1'479 similar samples on MalwareBazaar
TLSH	T10A45CF0373DD83A5C3725173BA66BB01AEBB7C2506B1F59B1FD4093DE920162921E673
TrID	63.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 11.6% (.EXE) Win64 Executable (generic) (10523/12/4) 7.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 5.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	SecuriteInfoCom
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

432

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Trojan-Downloader.Autoit.gen.22126.2277

Verdict:

No threats detected

Analysis date:

2024-09-12 07:29:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0e3129f1-aa72-4e39-a455-f7cf7469f7df

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan-Downloader.Autoit.gen.22126.2277.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66e29804751db35a8b9f7da5

Tags:

Inject

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

autoit fingerprint keylogger lolbin microsoft_visual_cc packed shell32

Link:

https://www.filescan.io/uploads/66e298049e62610887e8d739/reports/32226eca-980b-4e2b-bf15-57203f492cdc/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/38e142a7-7250-4884-aa3f-0186fcaefc5d

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1509900

Signature

AI detected suspicious sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059/

Threat name:

Win32.Backdoor.XtremeRAT

Status:

Malicious

First seen:

2024-09-12 07:28:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wjigtcnr5di75zqxi4enl6jho3p53ieru4sevmxad4mjdaghebmq._file

Verdict:

malicious

Formbook

5089e8bf32ebe54189b052eab160714b1e4ebe9808356fbb42e40721a1d4213b

Formbook

594ba6bbb8abba31fb7474ddb8d218e456d02db0af5cd5e97b5f83e748afc6fd

Formbook

72837dda6a46fef393a6420f045e6ae543908430d3a09fe8d4bfb6f6679c5b53

Formbook

b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7

Formbook

+ 1'469 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/240912-janbksyarc/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8680c7e6-b811-4e0e-8b96-0afabc30e541

Unpacked files

SH256 hash:

65ff9daaa822949b47a9a9582b568367f84061b35c9d0c3d79b737d8076dbdce

MD5 hash:

78b6fc3d6a498eb65e99342a52e8386b

SHA1 hash:

9ff0f89b853b26b14f955557921340851feb05de

Detections:

win_formbook_g0

win_formbook_w0

Link:

https://www.unpac.me/results/a9e6b9e3-5ad4-4768-9c3d-f4ca70cb5722/

Parent samples :

c675bb6df91d54c34b1cd975463415c5232cba63a76371c588359e01a2445370
b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7
72837dda6a46fef393a6420f045e6ae543908430d3a09fe8d4bfb6f6679c5b53
b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059
f3f0ac7ba7b93d8571adfa54987fb7374451f863b44946202bc623a528fc5b5f
b3c5c896606eb408bd97f255b916cda8cf8aa4291c3f68c5108c9ff0f5b7c0b7
9009393f8bbee65f3ba8ed3a6559a3dd7329d59ad2f4ae2043c06cd8f41d5e1e
ed3017e6c19e4afa7e7c20b6b63bcdc4a617274252af227aecbf8e15ca272dba

SH256 hash:

3ff85c7d19641b334803f9228a171d4a28b5ba9c81a7fcd979bcbeec4886be8a

MD5 hash:

b46e2bffd0945101989a826a738e8da1

SHA1 hash:

cf2bfc6dd1230b41845ff38f3f1fa5e21cb440a0

Link:

https://www.unpac.me/results/a9e6b9e3-5ad4-4768-9c3d-f4ca70cb5722/

SH256 hash:

b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059

MD5 hash:

4cead61470ed32fdfe7ebb7e1429b9d1

SHA1 hash:

961b5b88e48bcc5f66c6cf7f8843edda7b0e3a7a

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/a9e6b9e3-5ad4-4768-9c3d-f4ca70cb5722/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b2506989b1e8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIt Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	AutoIT packer

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::CopySid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::GetAce
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoCreateInstanceEx ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::mciSendStringW WINMM.dll::timeGetTime WINMM.dll::waveOutSetVolume
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW ADVAPI32.dll::CreateProcessWithLogonW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW IPHLPAPI.DLL::IcmpCreateFile KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW ADVAPI32.dll::GetUserNameW ADVAPI32.dll::LogonUserW ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetAddConnection2W MPR.dll::WNetUseConnectionW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegConnectRegistryW ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::BlockInput USER32.dll::CloseDesktop USER32.dll::CreateMenu USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::FindWindowW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample