MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4
SHA3-384 hash: 0ea3a4010a2748e599dcf3605641ae88f4bfe5f45ab9cd2c753b304a44870d9f0f968f37fb07cb0cdbc5e7d2431f0646
SHA1 hash: 73968fce8fc749147b960f696eed58dee37adeb1
MD5 hash: 493ece4e6645ac2e36f2342867354f7f
humanhash: purple-aspen-one-gee
File name:SecuriteInfo.com.Win32.PWSX-gen.16168.8416
Download: download sample
Signature Formbook
Create hunting rule
File size:699'904 bytes
First seen:2023-06-28 14:33:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:WmRlKPV54j4gE5innY+2lYt7ImWBMFYdPNXU0no1hooweWqZPZD:cYYinnYE8WYd1XxwBwexPZD
Threatray 1'088 similar samples on MalwareBazaar
TLSH T1F6E4383C19BD6B27D034D7E98FD48023F664847B3922EA2658C297D54756F922AC323F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.16168.8416
Verdict:
Suspicious activity
Analysis date:
2023-06-28 14:36:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/463d243a-3f60-4a56-8c35-d8091138f89d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/403572/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.16168.8416.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Restart of the analyzed sample
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/649c44dbf54afa614068321e/reports/b6bd112d-acda-4cf8-8b79-826028889256/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7ea529ee-425e-4316-a31f-7e25822846a4
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1262735
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-28 12:36:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxocoobioaly2fppauwcsoh4glkhc63zhp46ojxhla3jkiy3wlca._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
4678a529e9765c07270509abcbe33fc8bbe276d1d994f384018d1a567ef177fd
Formbook
4bbb39fcbea555b2ff359c3422f1058dcebd8e4cf0ae68d3b05f2198d57db9a8
Formbook
5d35bb95e95e3e166b00362d93f852af93448a4039894bbe25a55e79b29084d8
Formbook
60d16a2bcf5e1f176f5508be10e2229bb207855ed65241b2fb819eb801c9b105
Formbook
649e67dfa9829d849ab0e2e5dd9c40702dbb89cf5a8a02ad111c5f2df79c411f
Formbook
b5085635779b4d129e82c63c80c1c4fd1d37b979bd7f7336433745371fdee7b3
Formbook
b7e115be3acc119d6acb00f79694a8656feeed1d0435ab30d6e782fc617c9f72
Formbook
bf9106982a9c4fd6491224b98fe5cf99033e937e6ede6f6ff3bc725f21cb8273
Formbook
de2f27e35f85099ae0f5c6e1761ee0c3a55d2538abc91024f779f49af17491b7
Formbook
eacbd3784763b4f97f35d08baa9c11c48fcb08fbec721f1d52543ce2d036d5f5
Formbook
+ 1'078 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230628-rxe8gsah8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
084dd00b254b2dd187b70fe1e6c22ff7f6b1f455d57d2592887ce2b48a4666b1
MD5 hash:
547adfa827e3524d9b690a1564a10fbd
SHA1 hash:
a29eaad6689e0262761836a1aa1bb4d90f051aca
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
Parent samples :
b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4
d7dc562043640713d90764ada278ccd53dcd9c727688934a7495a0d11b47bd3f
SH256 hash:
1be909e32c0fcf556a8d278cb894f07106ffc1a6dbc06bd1487b5ffaa0047f2b
MD5 hash:
964402c93db1f9ee362918f95a459f02
SHA1 hash:
19c86d24eae9ad19ddb72f2892daad75b97c4a73
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
8022eb6a31ff09510ea4bc66e3a92f6f5ef5cd23412d10e12207e93ec38c3672
MD5 hash:
14ee8b8b7e47469317d1012f0898b111
SHA1 hash:
c6da4e2f1ab8c277129026648cbf97d8d6126245
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
1fa00aeb421ccf8ef0de7377ab2024709a73a78f076cc8e06c8ff023beb8030f
MD5 hash:
75f08dbb7db8b701881c7a46d0f03526
SHA1 hash:
1d518e5c8b65a9aed845f9cf328a171c4c16a531
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
084dd00b254b2dd187b70fe1e6c22ff7f6b1f455d57d2592887ce2b48a4666b1
MD5 hash:
547adfa827e3524d9b690a1564a10fbd
SHA1 hash:
a29eaad6689e0262761836a1aa1bb4d90f051aca
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
Parent samples :
b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4
d7dc562043640713d90764ada278ccd53dcd9c727688934a7495a0d11b47bd3f
SH256 hash:
1be909e32c0fcf556a8d278cb894f07106ffc1a6dbc06bd1487b5ffaa0047f2b
MD5 hash:
964402c93db1f9ee362918f95a459f02
SHA1 hash:
19c86d24eae9ad19ddb72f2892daad75b97c4a73
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
8022eb6a31ff09510ea4bc66e3a92f6f5ef5cd23412d10e12207e93ec38c3672
MD5 hash:
14ee8b8b7e47469317d1012f0898b111
SHA1 hash:
c6da4e2f1ab8c277129026648cbf97d8d6126245
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
1fa00aeb421ccf8ef0de7377ab2024709a73a78f076cc8e06c8ff023beb8030f
MD5 hash:
75f08dbb7db8b701881c7a46d0f03526
SHA1 hash:
1d518e5c8b65a9aed845f9cf328a171c4c16a531
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
084dd00b254b2dd187b70fe1e6c22ff7f6b1f455d57d2592887ce2b48a4666b1
MD5 hash:
547adfa827e3524d9b690a1564a10fbd
SHA1 hash:
a29eaad6689e0262761836a1aa1bb4d90f051aca
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
Parent samples :
b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4
d7dc562043640713d90764ada278ccd53dcd9c727688934a7495a0d11b47bd3f
SH256 hash:
1be909e32c0fcf556a8d278cb894f07106ffc1a6dbc06bd1487b5ffaa0047f2b
MD5 hash:
964402c93db1f9ee362918f95a459f02
SHA1 hash:
19c86d24eae9ad19ddb72f2892daad75b97c4a73
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
8022eb6a31ff09510ea4bc66e3a92f6f5ef5cd23412d10e12207e93ec38c3672
MD5 hash:
14ee8b8b7e47469317d1012f0898b111
SHA1 hash:
c6da4e2f1ab8c277129026648cbf97d8d6126245
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
1fa00aeb421ccf8ef0de7377ab2024709a73a78f076cc8e06c8ff023beb8030f
MD5 hash:
75f08dbb7db8b701881c7a46d0f03526
SHA1 hash:
1d518e5c8b65a9aed845f9cf328a171c4c16a531
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
084dd00b254b2dd187b70fe1e6c22ff7f6b1f455d57d2592887ce2b48a4666b1
MD5 hash:
547adfa827e3524d9b690a1564a10fbd
SHA1 hash:
a29eaad6689e0262761836a1aa1bb4d90f051aca
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
Parent samples :
b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4
d7dc562043640713d90764ada278ccd53dcd9c727688934a7495a0d11b47bd3f
SH256 hash:
1be909e32c0fcf556a8d278cb894f07106ffc1a6dbc06bd1487b5ffaa0047f2b
MD5 hash:
964402c93db1f9ee362918f95a459f02
SHA1 hash:
19c86d24eae9ad19ddb72f2892daad75b97c4a73
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
8022eb6a31ff09510ea4bc66e3a92f6f5ef5cd23412d10e12207e93ec38c3672
MD5 hash:
14ee8b8b7e47469317d1012f0898b111
SHA1 hash:
c6da4e2f1ab8c277129026648cbf97d8d6126245
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
1fa00aeb421ccf8ef0de7377ab2024709a73a78f076cc8e06c8ff023beb8030f
MD5 hash:
75f08dbb7db8b701881c7a46d0f03526
SHA1 hash:
1d518e5c8b65a9aed845f9cf328a171c4c16a531
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
084dd00b254b2dd187b70fe1e6c22ff7f6b1f455d57d2592887ce2b48a4666b1
MD5 hash:
547adfa827e3524d9b690a1564a10fbd
SHA1 hash:
a29eaad6689e0262761836a1aa1bb4d90f051aca
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
Parent samples :
b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4
d7dc562043640713d90764ada278ccd53dcd9c727688934a7495a0d11b47bd3f
SH256 hash:
1be909e32c0fcf556a8d278cb894f07106ffc1a6dbc06bd1487b5ffaa0047f2b
MD5 hash:
964402c93db1f9ee362918f95a459f02
SHA1 hash:
19c86d24eae9ad19ddb72f2892daad75b97c4a73
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
8022eb6a31ff09510ea4bc66e3a92f6f5ef5cd23412d10e12207e93ec38c3672
MD5 hash:
14ee8b8b7e47469317d1012f0898b111
SHA1 hash:
c6da4e2f1ab8c277129026648cbf97d8d6126245
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
1fa00aeb421ccf8ef0de7377ab2024709a73a78f076cc8e06c8ff023beb8030f
MD5 hash:
75f08dbb7db8b701881c7a46d0f03526
SHA1 hash:
1d518e5c8b65a9aed845f9cf328a171c4c16a531
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
SH256 hash:
b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4
MD5 hash:
493ece4e6645ac2e36f2342867354f7f
SHA1 hash:
73968fce8fc749147b960f696eed58dee37adeb1
Link:
https://www.unpac.me/results/ca66fa8b-f267-4061-9e66-2039ffe761b5/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b5dc27382870/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/403572/

Comments