MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b7e115be3acc119d6acb00f79694a8656feeed1d0435ab30d6e782fc617c9f72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | b7e115be3acc119d6acb00f79694a8656feeed1d0435ab30d6e782fc617c9f72 |
|---|---|
| SHA3-384 hash: | 1218176387492fceeff20eda22f370b00d1af988aa1c1a2116ca9c5d452e3caac7f11ee99f45f21b5910617c09b1dc04 |
| SHA1 hash: | 59663e515aa87cb8632fcdc1d992b985d460024a |
| MD5 hash: | 56b7f4249a28bd0760f0f717de793386 |
| humanhash: | may-network-tennessee-salami |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.21859 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'141'248 bytes |
| First seen: | 2022-09-06 10:45:52 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger) |
| ssdeep | 24576:zL4LJaZ6HPmn0etcP6tQxdepPeQigqO4:ALJHPmL8EPJiX |
| TLSH | T145355D0B21D40994C87651FCA4CCC5734BAA9E45E637C949BFCA9CAFF192F2C42D27A1 |
| TrID | 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 10d2c4f0f2d2b030 (10 x Loki, 8 x AgentTesla, 7 x Formbook) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.21859
Verdict:
Malicious activity
Analysis date:
2022-09-06 10:50:02 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-09-06 04:50:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
46
AV detection:
20 of 26 (76.92%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:de29 rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook payload
Formbook
Unpacked files
SH256 hash:
4c138cb59e0bf0a7693b7dc7599a99287f8c202f102aa23cfe6f09428c2e2259
MD5 hash:
859cc67295b35d6bcbf1edeedac79fcb
SHA1 hash:
0264dc7cf1ab6f931240dc297e7cf829fdca32f3
Detections:
FormBook
win_formbook_auto
win_formbook_g0
SH256 hash:
8b533ffaed24e0351e489b14aaac6960b731db189ce7ed0c0c02d4a546af8e63
MD5 hash:
dbc7be56e6e32349315170599c8b333f
SHA1 hash:
d8e5840e3574b87d435e55a65ac648e040871aee
SH256 hash:
6716a8f014fbc6c8f5fbf2e9fdc7e1fffd3d7b75d11a5f36cd070354855d0196
MD5 hash:
f14cc4caabfdfb6abc7963480f6a49ae
SHA1 hash:
bb56a5f94ddebb050d1366b87ddcfee5c05aa70f
SH256 hash:
983cb742f45d7573bece85b61c0cc486fba4b5d4bc25ce9bef8f2f2eb9611781
MD5 hash:
72bb3ee8ab6ac65143bc921637bfe216
SHA1 hash:
87d94332580acc77107f2200c970b1abb0eca558
SH256 hash:
9b4aee132a0228378d66a57fda3a2030952309ef74cf2db724ac916b04d8c034
MD5 hash:
93c6391d23c1aa1ed66fb13f82f2ee31
SHA1 hash:
220098c3047c32b51ae13a5cc1e9beeef3da6e18
SH256 hash:
b7e115be3acc119d6acb00f79694a8656feeed1d0435ab30d6e782fc617c9f72
MD5 hash:
56b7f4249a28bd0760f0f717de793386
SHA1 hash:
59663e515aa87cb8632fcdc1d992b985d460024a
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.