MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6
SHA3-384 hash: e158658ce39669dbed620057faef5165e4d030fb7019dd4df510386dc0268d3ff6f2aa982ed22d320e67b1a0090c2865
SHA1 hash: ae63b48e7390f764115421818730b708a44ce29a
MD5 hash: a1d6ff7f4e7fa054f9a94372d5000bff
humanhash: east-montana-foxtrot-jersey
File name:c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6
Download: download sample
Signature Formbook
Create hunting rule
File size:1'378'816 bytes
First seen:2024-07-04 12:41:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd3825b6e0410966f0c31f64b6c7644a (36 x AgentTesla, 15 x Formbook, 6 x RemcosRAT)
ssdeep 24576:jAHnh+eWsN3skA4RV1Hom2KXcmtcx8fB6H8RT/xHeaGAWTt:uh+ZkldoPKsacxWBIcHeR
TLSH T16055CF067391D06EFFAB9A734F59F21157B83D290023891F2A982D7DBDB12B1163D362
TrID 49.2% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.7% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon a0c0c6e6c4c4f919 (8 x AgentTesla, 5 x Formbook)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
364
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6
Verdict:
No threats detected
Analysis date:
2024-07-04 12:38:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c8c93447-6052-43c0-ad61-b164881b52b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Win.Trojan.Autoit-10032467-0
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=668699401005591c3c2e8940win10vpnfull_triage
Tags:
Autoit
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit epmicrosoft_visual_cc fingerprint keylogger lolbin microsoft_visual_cc packed shell32
Link:
https://www.filescan.io/uploads/6686989d910ce98966fbb7db/reports/37951b20-ab3d-463d-91a8-789660afc919/overview
Verdict:
Malicious
Labled as:
AIT:Trojan.Nymeria
Link:
https://www.hybrid-analysis.com/sample/c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/967f0a4e-ec01-4ba9-9c29-16677c0ccdac
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1467637
Signature
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6/
Threat name:
Win32.Trojan.Strab
Create hunting rule
Status:
Malicious
First seen:
2024-07-04 12:42:06 UTC
File Type:
PE (Exe)
Extracted files:
29
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfaeg465o7ppl3t6swsnl3p467fyvkaolxggox6fnm4g7ucnxo3a._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240704-pxb5qaygpc/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
AutoIT Executable
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/66072102-5b60-4efc-bf76-fa39ba91b127
Unpacked files
SH256 hash:
c775f9ac5579ec48e3b913fbe5924ea722c493feffe291ca3a2f319880f0afad
MD5 hash:
02b4b1eaa523d4b3a0591e1f91cf4e59
SHA1 hash:
58b672f3421f2c8830f9b176655574f674d1160c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
Parent samples :
e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6
c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6
SH256 hash:
11a05eb55eb03b4707decc435f0376c132608172641d8b6c711ee8acc578ae9b
MD5 hash:
0b5918ee9c03fa46bee31a2ec7451ac4
SHA1 hash:
e6145daf638fa9f6570d8286ff6c8c1b4f83b1b5
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
SH256 hash:
dcec3aef74cdbf3b5ea518b91d4d1c8f1ac771085888098ccfb139a2ee4eeede
MD5 hash:
98418c6d03c9efd406ac5d22c4f2cc57
SHA1 hash:
ea6627860a1a2f5d1b5586ae5d14c1c1bb7bf932
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
SH256 hash:
468c9ce83f3df965a1e79d2c9377413e9edba252c7d3cafa04d4d606d02f3651
MD5 hash:
1173d016ae238894f8ba593cb924e11d
SHA1 hash:
d84603fab24f4dbec19bbae46542c4c95c9a1ead
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
SH256 hash:
2f1e2f704ae14a89a9b92907d7f98daae63bc58fb3adbf812ca3ae0f5599147c
MD5 hash:
29da918b0cb589af974e96e7d1baaef5
SHA1 hash:
94aadc1c039c326ff22a59e0eef2847a7bd6a3ef
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
SH256 hash:
49e1f8e6dcbf777ebb2c64c595ffa930da4fbec190f76a0149f7d683194ffa4e
MD5 hash:
72461cf1dc3d9cd621ac04c4aa73178c
SHA1 hash:
32245877e2d2893490cff427cc96b16f179afa2e
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
SH256 hash:
ad2528c7f3e52c478a08c82626202459a1457be1103582d32e085a2c69d373f6
MD5 hash:
dffb8d0fc0327381c6723a258e3962ae
SHA1 hash:
176bfec4331b6ca524cc33234a9aa64b6b85b383
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
SH256 hash:
018ee0a615b0769f7881780a4f32bd3e72e888ff14cfc897761246887db8ba08
MD5 hash:
231520bc5e39d334140d4b14f50c2696
SHA1 hash:
04a323ce1e8e26f38d536db12c73676da21d0411
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
SH256 hash:
c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6
MD5 hash:
a1d6ff7f4e7fa054f9a94372d5000bff
SHA1 hash:
ae63b48e7390f764115421818730b708a44ce29a
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/7ccd9216-66fe-463c-8e1f-5068db7367e0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.DLL::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.DLL::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::TerminateProcess
KERNEL32.DLL::SetSystemPowerState
KERNEL32.DLL::LoadLibraryA
KERNEL32.DLL::LoadLibraryExW
KERNEL32.DLL::LoadLibraryW
KERNEL32.DLL::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.DLL::WriteConsoleW
KERNEL32.DLL::ReadConsoleW
KERNEL32.DLL::SetStdHandle
KERNEL32.DLL::GetConsoleCP
KERNEL32.DLL::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.DLL::CopyFileExW
KERNEL32.DLL::CopyFileW
KERNEL32.DLL::CreateDirectoryW
KERNEL32.DLL::CreateHardLinkW
KERNEL32.DLL::CreateFileW
IPHLPAPI.DLL::IcmpCreateFile
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.DLL::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments