MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5e617b42daec14d7fc20328b8fd9a86395ca742f205d997093f5a8258ba1ecb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5e617b42daec14d7fc20328b8fd9a86395ca742f205d997093f5a8258ba1ecb
SHA3-384 hash: e0e6332ebd244c31d34148fc3381e8f8c9fd0b0550186a226212a38f57428c1e8f5f17486ab332f361118d8e580ce23d
SHA1 hash: 923d7e778d07d0478a6b35158de59c4da9b17ae6
MD5 hash: b16ba74663c74fa3842a265e8a7a7da4
humanhash: mobile-south-echo-tango
File name:b16ba74663c74fa3842a265e8a7a7da4.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:443'373 bytes
First seen:2022-02-08 18:47:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:5wJfffffffffffffffffffffffffffffffffffffffffffff2fffffnfffffnffU:w8WnaM3pgmXTlykoM94D38YC
Threatray 13'163 similar samples on MalwareBazaar
TLSH T1BE94483AE78D9C9EC976CAF98675C3550E50AC1C6D515ECE23D23BCA1673ED6220C823
File icon (PE):PE icon
dhash icon 00ecd0f8f8f0c400 (26 x AgentTesla, 20 x SnakeKeylogger, 5 x Formbook)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/238479/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6202bb274077c8b9a02296b9/reports/d30ee741-f608-43ba-9804-e1e65a7b8eee/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/17fcd1be-cd0f-4b4e-9f4b-2235c3056d53
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/936548
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c5e617b42daec14d7fc20328b8fd9a86395ca742f205d997093f5a8258ba1ecb/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2022-02-08 11:33:32 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
34fc8a270fda2856448cb455e3dca4d8210f5e83f25f1fa8339d8f428a449466
Formbook
3c3ef93ea804d5d80ecbdb244ddf7fe2ab657f54089a397f0c79d89dfef5c95c
Formbook
4d1ac5962b58c0bf6386b85fc1c2029efb0c8d5ccf0054733795eec1ea8b3291
Formbook
703f4546b4adc3e685275a9840bafac150717c3259f629f6bf9bd8e5d191ad46
Formbook
a6e23730cd711af23e7900cbabb871b668d37a74dda0c97d63f3303167861cf5
Formbook
b1e2238ed835357f061456c7a38d0620cef8b78f0e1a9856133cc5b2805e0ed1
Formbook
caf586c9d78e7b0adc9d91286228eba817463d60b912651f2aa43288441d4d48
Formbook
dc65156bfa6da463f9eb980c3a551ba0cd494b53a55b3a2e9b41c766ca3c011c
Formbook
e8720afe9895124761086a0f00aa515997015669cc5332aebe99d5ea02ca7377
Formbook
f777ad0feb1db2da7abb7c793515f7af49d06a7b4fc5904a9da436ccbd59ddc3
Formbook
+ 13'153 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:asus loader rat
Link:
https://tria.ge/reports/220208-xfrsvadbgl/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Unpacked files
SH256 hash:
8a824b9990a37b0418f2135a9eeb0d0d29401557d1859879a839809d26cc5d41
MD5 hash:
69e27a7beda7330fbb867e2805690a81
SHA1 hash:
147c5ef4305764f1e24feaa4e7a718743ead72ef
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/02bd27eb-7a34-4921-afa9-27b5578e973d/
Parent samples :
c5e617b42daec14d7fc20328b8fd9a86395ca742f205d997093f5a8258ba1ecb
3d4166fcaa74af97893767e432c9393e96376ca8da0d1e36114729c7408a1a27
a2ef1147fb83cc34277e15d885f20bbdd4262459f6da12c607f5b5d90bfcb041
2f0668fe2dc8fe9bca5fdd3c62192cd9b86bf236e9559433110e580c842b9fb8
daf64aefe626d474f355e5d42de574fd52bc7f8afe382dce0e174e1cf4b23bf1
053166ff37507398e22d75b5ad58dc5a3732e670c3f86a7e328b489e3675fee4
61b29e885d09ab3ce5fc6f0e08fde19f6d34a926cf58518404105e846ca26310
106f2498125d96c6eeb8ba5243494936680e4e01c45c38ea3ffe4ed2e77c73d6
82f59dc21ab78418dfaa3c6ad30c6c776848db7d32e78dcefc80c30f34099c1a
3b0ea9fb4bcc9cebe136e3d53d6da997fcbc00ac690f5ec9381d75941be38875
35d9792701d7e60dff3464570fe8020c9136e86cffe8f19a4220b61b8eeb5e04
ab90e014c91318ac3616338c4340c31f1639db056f37e44ba794fe53ded87ff2
7535965340e3a37d74b7329bca8f67b82cfb299cef0c4419e8a04aa08f598d78
b6a5f7a958bdb00a9223004f9068976331ada2a513e921ab248ab71c5aebd59f
SH256 hash:
d307cc57b0f34fe9e6655147c7a68af9516cb01ee0963978857f471e81931649
MD5 hash:
6e321e22a9d4d4e86c587ae382e6b2ff
SHA1 hash:
fdb5eda5a3075c5e0b6020ef219980bab1d0fd23
Link:
https://www.unpac.me/results/02bd27eb-7a34-4921-afa9-27b5578e973d/
SH256 hash:
c5e617b42daec14d7fc20328b8fd9a86395ca742f205d997093f5a8258ba1ecb
MD5 hash:
b16ba74663c74fa3842a265e8a7a7da4
SHA1 hash:
923d7e778d07d0478a6b35158de59c4da9b17ae6
Link:
https://www.unpac.me/results/02bd27eb-7a34-4921-afa9-27b5578e973d/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe c5e617b42daec14d7fc20328b8fd9a86395ca742f205d997093f5a8258ba1ecb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2033766/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/238479/

Comments