MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6712885245cad12ca99d6746183646f3634e65e253165f068e936a8ac60905c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6712885245cad12ca99d6746183646f3634e65e253165f068e936a8ac60905c
SHA3-384 hash: ec2768ca0f67073b391884f456d05bc13ed6aefcc5459a7d2208142fed43357efae593a9f10d3df5448cb3ebada4d6e2
SHA1 hash: a824f4c43c02b884aa1185a5ebbb6e4d8465aa96
MD5 hash: 6057fd884c1361af640d0a9c96179319
humanhash: pasta-blue-eight-carbon
File name:SecuriteInfo.com.Trojan.PackedNET.1761.1186.21798
Download: download sample
Signature Formbook
Create hunting rule
File size:1'004'032 bytes
First seen:2023-01-11 12:58:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:7xefR5++9JIVvjANCfPizG8+gHW3C8v7j+bkw:76H9iNj7nizGdg23Hft
TLSH T1D325029F58C0B520EFC42175C752A9DC0EA73F05AAFAD55E9C937C2F6A2099C3E5018B
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.PackedNET.1761.1186.21798
Verdict:
Malicious activity
Analysis date:
2023-01-11 13:00:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e971561d-1bb4-48f4-9a22-414fdbf446fe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/351932/
Detection(s):
Can't access file ERROR
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63beb297a66e2eb297384e25/reports/2fbe9031-40b8-4569-bfeb-83cdd2306fd3/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5a2b73f0-3876-4ae6-8592-95ec85520bb5
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1149577
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6712885245cad12ca99d6746183646f3634e65e253165f068e936a8ac60905c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-01-11 12:59:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzysrbjelswrfsuz2z2gda3en43djzs6euywl4di5e3krldasboa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:adb9 rat spyware stealer trojan
Link:
https://tria.ge/reports/230111-p724wscd62/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f55edb4b-6f74-4158-bb72-766ebb5151e3
Unpacked files
SH256 hash:
b3dc07f87f6b0b4d66fd0f304a2b022133f08f25cbcef74b0dc75777e39529a7
MD5 hash:
1ab07a0e2352acbbf8b4a6e50375fb49
SHA1 hash:
ca6d874dc9e72f83689426b1eb6ad2c80673e3f3
Link:
https://www.unpac.me/results/b21db298-b27f-4e34-a2f0-764f9ddcbaaa/
SH256 hash:
d5718cfc5ded3ac791f539fab3a5559384b2a1694a0dc689f58e98e57bed18aa
MD5 hash:
207f7ee2a146b265261dbb94a29b06a9
SHA1 hash:
c2d0954cd772f6d6e6c020796fe90f3aee4c18bb
Link:
https://www.unpac.me/results/b21db298-b27f-4e34-a2f0-764f9ddcbaaa/
SH256 hash:
6792db3a341c3a82e8cabb3b8374b491e4acc9822ca5c9d813bc324e898fdda0
MD5 hash:
6764194756f42992ce295bc50693619a
SHA1 hash:
98310984a4cb46ff316583dfaabf8f8cecc734c6
Link:
https://www.unpac.me/results/b21db298-b27f-4e34-a2f0-764f9ddcbaaa/
SH256 hash:
849017c9b3fdcb9a435b3cf0a329a49fac6467dac3afbb5920673f69657b9a3b
MD5 hash:
a5d6458bb76abd290302e093f7c43b79
SHA1 hash:
780ab7b48ea972906dc7741c7fc6a9e810e3bbfe
Link:
https://www.unpac.me/results/b21db298-b27f-4e34-a2f0-764f9ddcbaaa/
SH256 hash:
ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747
MD5 hash:
89ac57478044c57c7195943116a521e0
SHA1 hash:
1ff2bafeed795423e3538d810bda8e1e3fcdcfa5
Link:
https://www.unpac.me/results/b21db298-b27f-4e34-a2f0-764f9ddcbaaa/
SH256 hash:
b6712885245cad12ca99d6746183646f3634e65e253165f068e936a8ac60905c
MD5 hash:
6057fd884c1361af640d0a9c96179319
SHA1 hash:
a824f4c43c02b884aa1185a5ebbb6e4d8465aa96
Link:
https://www.unpac.me/results/b21db298-b27f-4e34-a2f0-764f9ddcbaaa/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b6712885245c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/b6712885245cad12ca99d6746183646f3634e65e253165f068e936a8ac60905c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/351932/

Comments