MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4d430cfe4399aa57154854567d17ef118b6d0eee083b683f81957d2057949b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4d430cfe4399aa57154854567d17ef118b6d0eee083b683f81957d2057949b0
SHA3-384 hash: ffaae555cd68ab729497fdc308802a8ad666754b26392a8d0d79408c861b44d59b076aa96ab0cb985e52ead1dedd6279
SHA1 hash: e65a9edc4bf551c9eb0f75e813980c3d96966203
MD5 hash: bc73f146c5f10a875ba645b7c9b567bd
humanhash: butter-tennis-single-triple
File name:SecuriteInfo.com.W32.AIDetectNet.01.13966.4765
Download: download sample
Signature FormBook
Create hunting rule
File size:603'136 bytes
First seen:2022-05-30 02:40:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:LiO61AETZKakqeI7TH8mf1Bn2ki0/5uo23XAL7SznHrtEibq:I+qpkqeCtf1Bn2bI23X+7yLt
Threatray 13'483 similar samples on MalwareBazaar
TLSH T1C3D41229E7EE732DC0FD6FF6C970851003B9E825D926D6A97D8034FE4E60B81629125F
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 00ccf096ccc0d400 (21 x FormBook, 18 x AgentTesla, 11 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
252
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetectNet.01.13966.4765
Verdict:
Malicious activity
Analysis date:
2022-05-30 02:40:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/48fcb217-c455-4de8-866f-135170a69a77

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/275294/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.13966.4765.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/62942ed5206e08161844ff0d/reports/dd36fff7-cc71-4205-b3b3-5036a9fbd7cb/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e9ecddd8-fcf8-4d98-8ffb-b40336b9ba22
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1003354
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d4d430cfe4399aa57154854567d17ef118b6d0eee083b683f81957d2057949b0/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-05-30 00:45:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2tkdbt7ehgnkk4kuqvcwpul66emlnuho4cb3na7ydfl5eblzjgya._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
19a9ec9da618f09710fd8e6e1daec72377e05e78bd7469f33e203a9529d712fd
FormBook
38dcb9b9943a8e9c79592af3c754aae2feb84c832e7111828224f2bd663f3d82
FormBook
44ba196d26ded5256953332dbcf8f1e4eef73522687836158ec13065917bb36c
FormBook
98b28d84bb0b1479d10646a5d34d02f9e25718adc285634fb11d407188089e1d
FormBook
ace8cc8c63d042c7a8a617005e2cf551185e8b1491aed4a91d56c6f44be62912
FormBook
dc0ed0d428679dd6269a17ca9c6fd5d0af9ac0cf62fd66c3abf30736a0df9ad2
FormBook
ddefebb59f9e4b8fc00e13686024f829fbc7d82a2b0d07fd29748071708a5850
FormBook
+ 13'473 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:t19g rat spyware stealer trojan
Link:
https://tria.ge/reports/220530-c6fhaafafk/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook Payload
Formbook
Unpacked files
SH256 hash:
22abd8cd411559d6c2d6665d82495f9955656f03a9cccd1f17b42fb9c25e8a97
MD5 hash:
6a48a2225ff2075094b5faebe11e7df4
SHA1 hash:
09d61dd5729fb37b61dc91de43999d4d1c5ab302
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/d122c99f-b444-42d4-8489-8d6ff4abd12a/
Parent samples :
d4d430cfe4399aa57154854567d17ef118b6d0eee083b683f81957d2057949b0
262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09
4b8c3b49cc5ceaea396ffc0444d625d7cc3c231b973f2775a23ab3cafece504d
b1313b8c8d249728b5fe9756332a98c1415468df5f7001f2c1e4c26826edb83e
a06756251dbd94ca9bbecb73e4b5e9c768d3fada398cccae4a59323aebb31eab
SH256 hash:
7c271c6287d6c60deb9f30571dfd23a4c75ccb80d0023b5861755787a0933cd8
MD5 hash:
72ed2e5fdbd7df1c2e088ff524dec9cc
SHA1 hash:
c14095590ed19c905dfb5ff863c9a993296ead4a
Link:
https://www.unpac.me/results/d122c99f-b444-42d4-8489-8d6ff4abd12a/
SH256 hash:
840be1d54ac08fdec3556b93ff92af7e2f6d7c909a7606c59c5ac777670e2742
MD5 hash:
cc4a8210cb3e6146e928003944c15fbf
SHA1 hash:
e218e2b2a8c8e204c19d6cc6aec987b87544d566
Link:
https://www.unpac.me/results/d122c99f-b444-42d4-8489-8d6ff4abd12a/
SH256 hash:
245f041a715581e0560213132872bfbe5934176a0057d348d8ed511f6e9c609b
MD5 hash:
d879803129909763bed9713fbecc5f71
SHA1 hash:
3247c8b243cff148fd2597e06562038584dccd04
Link:
https://www.unpac.me/results/d122c99f-b444-42d4-8489-8d6ff4abd12a/
SH256 hash:
d4d430cfe4399aa57154854567d17ef118b6d0eee083b683f81957d2057949b0
MD5 hash:
bc73f146c5f10a875ba645b7c9b567bd
SHA1 hash:
e65a9edc4bf551c9eb0f75e813980c3d96966203
Link:
https://www.unpac.me/results/d122c99f-b444-42d4-8489-8d6ff4abd12a/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d4d430cfe439/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4d430cfe4399aa57154854567d17ef118b6d0eee083b683f81957d2057949b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/275294/

Comments