MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789
SHA3-384 hash: b3ea13a341549bd23ddaba41c9e9f6c6e2ee9d0ea803f1cee01529eaa7304a134565a88049c688c32df84ca17fd9b0f3
SHA1 hash: 25af81908bfa58bee6d7eb704504d270fa612e44
MD5 hash: 62f0e84a989f520db3b1463e02b24a91
humanhash: mike-oklahoma-march-freddie
File name:SecuriteInfo.com.Win32.TrojanX-gen.24688.16171
Download: download sample
Signature Formbook
Create hunting rule
File size:881'664 bytes
First seen:2023-09-18 19:35:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:J8/kSMdr3GNUAn9cNNeX8X/iTS46omhPw7tquxyR6VXzgRwGuwcwBTuiCnTKqUL0:J8PquxyR6VwuwcwYDELVmxVL
Threatray 74 similar samples on MalwareBazaar
TLSH T16515093530FA2516C373E7E20BD9ACBE9799F637221EF637248113974652E019AC2736
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.TrojanX-gen.24688.16171
Verdict:
No threats detected
Analysis date:
2023-09-18 19:39:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b228c74c-374e-440c-9049-86c32fe35785

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/449451/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.24688.16171.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6508a6a40870810f01819047/reports/f940470f-1bbb-4247-b6e6-9a7cd9c8c503/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b8a40da-36c6-4af8-8778-0f66de2e4b0c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1310323
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-09-18 19:36:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3fogxlvcqitbj5o3s5ajqqwdq4lgzsoqln5zjn2njmv3nwdm6eq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
05360352816fd2dfd09c05a57131f86c59fd38f7153c5261973216cf596ad077
Formbook
07eb84ab44d23516c584c1682f5d417c56ec00eb40e04ed2b4469ba2260b6338
Formbook
19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3
Formbook
28375a1b1f2ea0e88846a60930ad76d4c68bd3f0545daebced5fb64fca085616
Formbook
75a9fc79b2513a8964a0dcf3a0749a399a857d3feb2fa3c0d62de6f51ea5971f
Formbook
8326158d0aea2a3ee6a49cc3f88e1c3779eb479790a8b0451133a09c1ca0a777
Formbook
9fe145f64a6f2ed8283b9bfb1e97a3c93087d8495a53af984d619760c7d859a5
Formbook
a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048
Formbook
de99e6f0be1e9a5d12fa7d4fe82b34cfb6ba6b85cee18e4acec0d7f97593bcbf
Formbook
+ 64 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230918-ya8d3scd8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
69753ecb17113e4abcbdb030e4912f7442a8e6f79cf1929c5a0f823ea65a5c6d
MD5 hash:
1a28ac90936cf703f2dc67434ef71668
SHA1 hash:
80d426a568d65467cee0d4aefa602ed7d95ec923
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
Parent samples :
a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048
becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789
SH256 hash:
52fc517cce669ae1bb30d77cddc0f8ed188c79e36ee31f03bccf69e2dac4f1e4
MD5 hash:
9dbed57e46235dd7337e4e8c64a8ad65
SHA1 hash:
bc4ee2d01a213a18851bffe83728c6edfd746298
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
b0168a7d53c193ce770a2f7c62a1cb735395ce0abeb4af3ec78b3d564ad2b4ce
MD5 hash:
96f8031a57254808b277fd89512c7fc9
SHA1 hash:
e316333b2cb9e31d48013010d6c5f6b69d7233c2
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
4a8d70ece798fb6955e46bdb4b4813924a3bbcf205e585fd0aef148123a44489
MD5 hash:
3bcd5e9d69da03ebe27b9c2e472d9e8d
SHA1 hash:
aa268bd00ed60a5907b4b2a669ddd21a1b8bb4da
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
784d4e0af30bcca58d54f86b6966e1c147bcc194a99126ebe79538e9084f6d80
MD5 hash:
5caf74e6818e40e82651781613a42425
SHA1 hash:
2a182b1552373e0907bfd03db31120596df994d0
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
1f0f0de9acaf7369442d4ef2a412d2ca08913c6921003de04b397e893e03e527
MD5 hash:
6a0fd0c5b2c170ca01041c4d7952ce99
SHA1 hash:
f788a85862c679b1ec49f9f2f87dde14d884344b
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
b8855f96bdb462ec4eca1894976af848b5c84e72aa7c016e4c21872557255f56
MD5 hash:
f54934e24e07871dd8748b9410353037
SHA1 hash:
c821bc3cabad4c2844191a20c3437473d28eb0a9
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
3cc9b0d2b57b64b1a2c96e1c8d9ea42f1e2eaec5273ea74bc4f730e2eb04b4d1
MD5 hash:
5387641b46f87b8cfdcdf6c5fb0e93ff
SHA1 hash:
c79efc0fd9c5ba1ae96b55d4b91a4b5275054346
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
779b12efe3cf69bb7612c5dcbc4dd8269fd664c1365bb3904e801a74e2d136f2
MD5 hash:
49d86afa392b742d7f816b43c8af5a32
SHA1 hash:
8d5c8756fa94cbb4c9c321fcbe794bd3abc1fd33
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
37aae28fbbec64b6ad0c74921eee8068500eaa27f509830ee9a907a8bf671ae1
MD5 hash:
415daa3e653caa9194b084c028a0fd84
SHA1 hash:
2dac4eff561c3840ddd561469ebbb38cc6e50abc
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
a1e6282442668b923cb8fcbddb767116ee4647f0f4a87470d29bb191dbd89ce4
MD5 hash:
624e7b5ceb88285cec05c3cf9eca306a
SHA1 hash:
1ec368dcc48c8cbf2f951bb9a4dcdcc78ae11815
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
SH256 hash:
becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789
MD5 hash:
62f0e84a989f520db3b1463e02b24a91
SHA1 hash:
25af81908bfa58bee6d7eb704504d270fa612e44
Link:
https://www.unpac.me/results/00989adb-6e91-4d1c-9e68-9f9751d77778/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2712355/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/449451/

Comments