MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c02d0961f01cedbbe7d169de4af2e656d3446ca9a4dbe118738cb2269ab773c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c02d0961f01cedbbe7d169de4af2e656d3446ca9a4dbe118738cb2269ab773c7
SHA3-384 hash: bf8cffdec4bb4237421ef268e44be33088629f2cd3720f65888ee1cfb8287866707ad0c6433b0451cd997a5ceb13d13c
SHA1 hash: bc8c2584c20f87f0fdb7375eee867e3b091ff774
MD5 hash: a355672e7c84349c63dc1f45026fff72
humanhash: enemy-michigan-steak-west
File name:SecuriteInfo.com.Win32.CrypterX-gen.11132.11927
Download: download sample
Signature Formbook
Create hunting rule
File size:734'720 bytes
First seen:2024-01-16 06:21:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ntvJz/IIHF3fKqHCgjs9CoCicoI66Ehg4p46TGebWSPXW+pVyB3Zf+QScT1kIwek:tvJz/IIHFv9Hns9r3coI6/g4p4MNbWMr
TLSH T157F4233633BCC677CAFD0676B0AC02291B715D943326EBED8994F0DD29CB742512929B
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0c9ca3c6f071b440 (5 x AgentTesla, 1 x Formbook, 1 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
385
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/471060/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.CrypterX-gen.11132.11927.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65a6208c1bf798554ab29088/reports/2f10d819-7f6c-4034-ae5a-89972615121c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/c02d0961f01cedbbe7d169de4af2e656d3446ca9a4dbe118738cb2269ab773c7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bd621dde-a241-41fc-86da-6ef926446f7b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1375169
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c02d0961f01cedbbe7d169de4af2e656d3446ca9a4dbe118738cb2269ab773c7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c02d0961f01cedbbe7d169de4af2e656d3446ca9a4dbe118738cb2269ab773c7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-01-16 06:22:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yawqsypqdtw3xz6rnhpev4xgk3jui3fjutn6cgdtrszcngvxopdq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240116-g4wtpsfeh4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
f4c6e4738ae5626c9867d5fa5894127203870c3cac9fcdb76dbae0c3ce88bc1c
MD5 hash:
630922fe41a133e6e0e49c2e7003fb65
SHA1 hash:
b2f4955b5cc3fce04a04754cfd7d2c61f3da8f07
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
Parent samples :
c9d75a27ed76fa8006bbfb067fca6f80506535a83914f7ae44e238c0f816c26d
c02d0961f01cedbbe7d169de4af2e656d3446ca9a4dbe118738cb2269ab773c7
SH256 hash:
da43bc6bc0659407ea9ab73001bd9d2569017fa6386915d4d4671e64c9be5056
MD5 hash:
d3a98684bc01380a4507354399f7616c
SHA1 hash:
e26048cd342489a826e629cbe477a9838e2d0c9f
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
761c365377b932c963dde44ad0132b693c24cd1060dffdf61b6a1fb02a29309f
MD5 hash:
ce16e1909361f772057254d947662c1e
SHA1 hash:
94248eca0d0982700be42638565c1bf951cc8ec7
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
21afe82a0b71ee589c26f32dc88e0a6e22817f21194b2a83f1807c6cecc8c818
MD5 hash:
440bb4db146ccb1161ac2bcf365d7676
SHA1 hash:
506eda511b46df6e95d86861e70fda81307f8623
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
2ae765d8175b8aad04cbd95188d042b615396e87411902bce0355a52cc869155
MD5 hash:
d9f4449d94cc331a685d4e4e9d79de12
SHA1 hash:
39c821a0792903a932f7134892b67e6d9b5e9101
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
e228ad921050afacd89f9ea5da6224995e9709c4fb599afb9deb2b860ec6e38f
MD5 hash:
e8042e0e66094a37eceb67c63a546dc0
SHA1 hash:
ec61dbafe3c210e1cd175a92b2e9c42a004aae97
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
6e13dc57851c0d7626f56da2ffa25d8b074f64ea919e2193551ae7c8013b0ee5
MD5 hash:
c59a1c6f0376607c2483176a629f6752
SHA1 hash:
db2924d69829a3cc70e3ba61a56f3998bbe62cae
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
0ef4bcbbaaf5d8c9e6deb62ee1c5344dde2d42e15f7af288d904c4fe79cca281
MD5 hash:
e5e6ef3c34ead661c653350eaabea7e2
SHA1 hash:
b5366a5d23a5f0bdeaa26e9c6168e509e4cc9b53
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
cda4377a3f7e88287369135cba6c39379af2cb8157262086645b19fae35bdabb
MD5 hash:
ade60b3affd7e9ba682ec5000ab3f5ae
SHA1 hash:
5308a330e5fbba33340bcaff17e67f5704cf4bce
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
8ee6076dd8c1c7e21d91a46ea7a7bf7a5c2f0ce6920e040195affee728eb98f1
MD5 hash:
d6127082f1959d52ca24db839ee92242
SHA1 hash:
50e6a71b2af4d67a4dbfaf615eeaba367ecd8275
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
52585caee66d84de61e245e5300e8eedadd3e1f5f8712b7d77897f26d3f15212
MD5 hash:
1f45930c04357b3b5a602330046b06ac
SHA1 hash:
1cc9293a85b420d5d252af11e1ee0ab3039b3691
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
SH256 hash:
c02d0961f01cedbbe7d169de4af2e656d3446ca9a4dbe118738cb2269ab773c7
MD5 hash:
a355672e7c84349c63dc1f45026fff72
SHA1 hash:
bc8c2584c20f87f0fdb7375eee867e3b091ff774
Link:
https://www.unpac.me/results/00890c2f-844a-4c18-8816-2593d587d8d8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/c02d0961f01cedbbe7d169de4af2e656d3446ca9a4dbe118738cb2269ab773c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/471060/

Comments