MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ba3eb6491a8a4953418407379da280e591d403f2ada5f3ac941bcfaab1951418. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | ba3eb6491a8a4953418407379da280e591d403f2ada5f3ac941bcfaab1951418 |
|---|---|
| SHA3-384 hash: | 868ffda5a1685303a05dc163ff3e23af1db34e734e3813a7ed1d40b67d8edd878baa92ee5330c46d9a06d81f0f55ecef |
| SHA1 hash: | 5a6c93967f53db601db0f4319079233e0a667e8a |
| MD5 hash: | 86adebdf71ed2c8db7a2ae0b5c3b65ea |
| humanhash: | washington-pip-twenty-seven |
| File name: | SecuriteInfo.com.Scr.Malcodegdn30.402.25190 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 663'552 bytes |
| First seen: | 2022-05-20 12:48:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'472 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:LGIEj6+1sCmJUXtF9IYeLtLN2O69djNJ2LR4AHFujLbL:SonWF9EPY3f6Fu/ |
| TLSH | T1A2E401182AE74B12E1AE5FB9A1A1049007BEAE177953F31FCF5070981EF33944592AB7 |
| TrID | 54.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 23.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 7.8% (.EXE) Win64 Executable (generic) (10523/12/4) 4.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.3% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 00071a1b52522920 (18 x RemcosRAT, 4 x Formbook, 1 x AgentTesla) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Scr.Malcodegdn30.402.25190
Verdict:
Malicious activity
Analysis date:
2022-05-20 13:12:55 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
xloader
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-05-20 12:49:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
16 of 26 (61.54%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:hd93 loader rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
62ad8ebef68c09f35defbc804c7a625b5a5604fe6d19096ed2592683bb0423e4
MD5 hash:
c45067c7e1894e413cf98ce09ff126f4
SHA1 hash:
c5ecfe3459856fdad9536cfe9d061f2ede72ec49
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
a3334b5a84d0435fabcb223b6db6ad87546f00e32ea52090cbf10da9532f38cd
MD5 hash:
3bd2a1ccebc8ce2ecd606f2ed6c7340a
SHA1 hash:
c42ec46f6cd83c28e7d85bf5a1d5fa20ebcd8d2f
SH256 hash:
106fc0a58c6b72a6dcd1ae784547521ec21b22835f293aa1f48297d784a04996
MD5 hash:
aa86bc3e2ae73ad190fbf77b1b020c0f
SHA1 hash:
62035a3777e0b9c32dc026ea6306094075f8fa0c
SH256 hash:
ee57aa03cff72e4bcc2af0c07250d84277a04a98578e964fbc8b6950841568ba
MD5 hash:
192a56c4f49dcfb181fcc3ef6e5cef2f
SHA1 hash:
34d3e609d824d29a3e9163571163d738bb2d7852
SH256 hash:
ba3eb6491a8a4953418407379da280e591d403f2ada5f3ac941bcfaab1951418
MD5 hash:
86adebdf71ed2c8db7a2ae0b5c3b65ea
SHA1 hash:
5a6c93967f53db601db0f4319079233e0a667e8a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.