MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5d15ff5604856647866fcb66e6353cf860114ffe01af6662f53c2a39a7676d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5d15ff5604856647866fcb66e6353cf860114ffe01af6662f53c2a39a7676d9
SHA3-384 hash: 2f76f3ef86f30c74ecd313c9b1d8dd4b81c66a176e70a4c1f7e80dfb39e4906848699c95f3ce0bba59f4cf964f83bc3f
SHA1 hash: a1a7554c594adb55378618e96db886dff7d6665b
MD5 hash: 9bfeae8618a808b2936337e2454f7430
humanhash: purple-sierra-apart-hot
File name:SecuriteInfo.com.Trojan.Mardom.PN.10.9451.1264
Download: download sample
Signature Formbook
Create hunting rule
File size:649'728 bytes
First seen:2022-04-26 10:40:51 UTC
Last seen:2022-04-27 18:53:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:lw03UsVZmRIAijaPWNXW9T8o3rPvq5gVGYBZOszk09FySaY2+ooIeBPEwJFdgV5U:TVTAi0D7PCmV3ZpBMp/+HPhV0a2s4m
Threatray 12'378 similar samples on MalwareBazaar
TLSH T16FD49E8A23D6F826F33F2BB1D69CF65183A151C7D53A83BB00A091D9A7712E46D911F3
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/266745/
Detection(s):
SecuriteInfo.com.Trojan.Mardom.PN.10.9451.1264.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/6267cc54fac433a7cc886010/reports/8b297420-5752-426c-837f-13f1a63747f8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5331d526-cea9-4d8e-b9b0-147f916f66ab
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/983150
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d5d15ff5604856647866fcb66e6353cf860114ffe01af6662f53c2a39a7676d9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-26 08:25:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xiv75lajblgi6dg7s3g4y2tz6dacfh74anpmzrpkpbkhgtwo3mq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02a417e5e680719a68ae77c65cb7deb70b85c839484fee128b77cc920674f18b
Formbook
1713e0bbb0108206edab4a49cfc1cd04ffbd53d93cbc6e61d7fe97896ddbbcd1
Formbook
2591e80a22e5b0b656e944afbdf80f6309d1f600315a9885d8ae92cc78e83933
Formbook
2ed8aeaf73ee1a3caf7eb0be7814868c4100efbe1b021e2d964db3b638dc7f3c
Formbook
5091b0812652b76aa775615c4887c2f01934763ebd857bb0cbd40f3debc36770
Formbook
a94cf69dea9775df9f51f32d9591f7208ac9c712289a1b851c30de3938b5a976
Formbook
a96ddfe26cc41ec92563b0b721a0036e9405ac08f617d5289a921ad054b4ae5c
Formbook
ace8d85c2f02bd3d531cd8d609d23c6d35588ecce52f40a8d129b39a6b1d7723
Formbook
e04c2819db3610dc0498ae022644d1b2ab06927cc4fadf23b200af70b551d6d2
Formbook
ec575e5cdf3da323c27e65f3042586173ca50ba0682b733a61f0b47f80c3004e
Formbook
+ 12'368 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:s3s3 rat spyware stealer trojan
Link:
https://tria.ge/reports/220426-mq39hsgbhr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Unpacked files
SH256 hash:
072f4f8ae3bf501da1075c9689b1e76d2f3def6d05686be3af0f8a90f965d784
MD5 hash:
9d3c6d818a558a5718f0bc65bb953efb
SHA1 hash:
0631e3047afd1443452de5d323f2910eb371b75f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/91e112cb-a5c9-413f-8457-8615876c5249/
Parent samples :
d5d15ff5604856647866fcb66e6353cf860114ffe01af6662f53c2a39a7676d9
1a2b06d9313d1317f16483b27f97bb569dffa8e22c1eddd25fe753a92146543b
c69a8cae5c55eb104275465b7e243114b151f49a54997cb496aebb747b4bfc50
6fc02ab37d33d1c6b53b81a7df2bc2abf5bec4651c4a8f93280ed6f46dd38f17
81398fcf0e9612b507cbdf18df673c828d8e08bd8a6abbfcf00261fe84e0bb8d
8f0fba4653d18b7a2b79042ad9f43404cf9adfb4c36cdb6e549647de16c8139e
45b1927934099ea95d315972f7f128ba3af4a64aa483d964f94c599e8e16f094
acb0ec13d308fba63fbc5fd12a66d4f72e61692bcb04bd051ec7844aed438e3e
c2e38b05804fa43eb0cd54de0187ef7d90aa79191877124a504690172ca33b78
1dc7309f7dd394071a6b83e32be1cd98484f813b22790b0a7ec426488cfd82cb
0c40251e1bc8bdd47fbd6b3d235ca27d95801b716734633f7e637ae113149b26
b5fcf18c0ac1815c33ea1a6691bd69f1897b772184231beaf1e4f3f92882ae3e
b8f378b349e37f3590cb8cb4c80a4c9928e79eee8e02c7a28936955989326af6
844c895254d53e80e0e0f00a2c8e1e212db8ac218ca8f5b8a9b6c20e346e280a
fa8634a43c5dfb22286abeaa9f3c1a62af85ebb4052be0257cdfa50895148876
SH256 hash:
c611a6ceb263401ed18ff93961bd6d0cdf8757e48d8e76b13943e85b9d3b5a0b
MD5 hash:
f9b293305bd04eee511c0ffd0e7f29d7
SHA1 hash:
fd981a9537a903422311f582defc1c8fd97248af
Link:
https://www.unpac.me/results/91e112cb-a5c9-413f-8457-8615876c5249/
SH256 hash:
7d170109f352f251d7ac012882e005b059b0db5ecce7520acf7be2ba8f13792a
MD5 hash:
72403055ee098f50bcc8a238fdbef878
SHA1 hash:
eb5ed9b38f5a23bb00b221acf3f7233aa2e9299d
Link:
https://www.unpac.me/results/91e112cb-a5c9-413f-8457-8615876c5249/
SH256 hash:
f7cfefeeb635a25ea33b8921d2da4b46d0f301fded20f297921769ad664760e5
MD5 hash:
fc05ef30d9d06337930de3d0cd958426
SHA1 hash:
b1b9ae6702b163a47fcb6151eb9cd45c337afa38
Link:
https://www.unpac.me/results/91e112cb-a5c9-413f-8457-8615876c5249/
SH256 hash:
21da0a74bf4268a9ce468230c1dfa9b1ac8ae5d59bc9fa3c9a5c41d5c7684fd2
MD5 hash:
796fb628f699a0d18448eb2e4ef11b69
SHA1 hash:
7aa8b830afc32a9a7ea5c0f79c894cf42c49df64
Link:
https://www.unpac.me/results/91e112cb-a5c9-413f-8457-8615876c5249/
SH256 hash:
d5d15ff5604856647866fcb66e6353cf860114ffe01af6662f53c2a39a7676d9
MD5 hash:
9bfeae8618a808b2936337e2454f7430
SHA1 hash:
a1a7554c594adb55378618e96db886dff7d6665b
Link:
https://www.unpac.me/results/91e112cb-a5c9-413f-8457-8615876c5249/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d5d15ff5604856647866fcb66e6353cf860114ffe01af6662f53c2a39a7676d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/266745/

Comments