MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28
SHA3-384 hash: df9bb96d7468546c10dda1113273ab2874b313ba7a8ed81e4af8c6859af3e5cfc7cc53eca5fd04582428bb4dc0aafa2c
SHA1 hash: fd7ebfa868cec0fb4f6083c8b141984be52cf421
MD5 hash: 3de62507ad47817c02c4efe9ccbf61e0
humanhash: helium-sink-london-alabama
File name:SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076
Download: download sample
Signature Formbook
Create hunting rule
File size:900'608 bytes
First seen:2022-10-07 03:27:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:OBJ2ugTsHabvZlEon/ihpF8v+qqhh8rLoL7L4QH3GB:BwHyZ+TpF8FuVX
TLSH T1B71549BA12D54117E82532B5D887D1F32AFBAD602051D5CB6AD72FAFBC402BB9113387
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 8673acc6466c3182 (5 x Formbook, 4 x SnakeKeylogger, 2 x Loki)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/317479/
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633f9cc70d3d21420ccaba08/reports/6d63ada7-0e53-4980-bcb9-867ddf146fac/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ab610135-647c-46f4-a024-0ffcab9ffe4c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1085459
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-10-07 01:56:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
20 of 39 (51.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3yser6ju6jifah4f6b6df4s6pz7bgnjin6usodx4wo7g26uniua._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:wyhq rat spyware stealer trojan
Link:
https://tria.ge/reports/221007-d1b4cabffp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/603c6d1b-dcfc-4b08-92e2-5833de31acaa
Unpacked files
SH256 hash:
a5010e033c8048ac51fe2e40125e92767aa9ffdd63c2ad6a587f7c7f29bc81b9
MD5 hash:
3f374e8849a3b47576f4e9c5e73a93f8
SHA1 hash:
2345e6c85446dcc07c9eec39b96fbd9e8f684de3
Detections:
XLoader
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/1608f48e-a935-4bbf-b70d-4c929ad82373/
Parent samples :
b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28
7a61c229cc9d8607242df81167562e499ea2dd36624744bc871d535222367dc3
b35cfe6096c42b13838fcad82902889405e6d37607aebd86ab982b47b610c80c
6e5d99d18277264f3c4da40f9ac2233e1adfde344174dcdcb9f06fc1ed545f80
SH256 hash:
50cc2539e94a6825df8bed0541ac5e43aa5c1c38d09a1a8d2826530fdb58fd9f
MD5 hash:
8d0d283a61bc6340b4d0e2057e32c726
SHA1 hash:
38bc27ec23c101a638c8e3d770aa4f049ced084a
Link:
https://www.unpac.me/results/1608f48e-a935-4bbf-b70d-4c929ad82373/
SH256 hash:
70dfa4c873605ab0fcdcb62be2a970da110535280d8dc88261edbe1ed2865307
MD5 hash:
d5b0f8aff064b3e828421b48efccd312
SHA1 hash:
724f4bc7ab4e08c45562748b739c8f7496a5ad8f
Link:
https://www.unpac.me/results/1608f48e-a935-4bbf-b70d-4c929ad82373/
SH256 hash:
4b7d02b717f1f5db54ec82236b5dd40ab9d1c31a4f62e76d06acba2226402795
MD5 hash:
733f852823b9985970f640034826cce4
SHA1 hash:
566b0de58926618c25adf3b16e0bf754857b219b
Link:
https://www.unpac.me/results/1608f48e-a935-4bbf-b70d-4c929ad82373/
SH256 hash:
1383999cb3682a0a0a54fad8a8e3f0fda2d4ce6422fa35286cece258aa1844a1
MD5 hash:
d891ee2f90e3392ee593067a038f3335
SHA1 hash:
347e96ac60f38938b0061ce5c21bec28c87f71f9
Link:
https://www.unpac.me/results/1608f48e-a935-4bbf-b70d-4c929ad82373/
SH256 hash:
142663a4278a763161413260e54ec73975a6430784c7fd5db373f7d6990d3647
MD5 hash:
12ef35e979e2031ba86c5a4eaf0c75f0
SHA1 hash:
098e9dcaf4c72988dd0a01f1c51bd809d1a100ff
Link:
https://www.unpac.me/results/1608f48e-a935-4bbf-b70d-4c929ad82373/
SH256 hash:
b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28
MD5 hash:
3de62507ad47817c02c4efe9ccbf61e0
SHA1 hash:
fd7ebfa868cec0fb4f6083c8b141984be52cf421
Link:
https://www.unpac.me/results/1608f48e-a935-4bbf-b70d-4c929ad82373/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/317479/

Comments