MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed570698ccddfc346f65b5b86045d8af239e0d2400acd5836818b95e7b658cff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed570698ccddfc346f65b5b86045d8af239e0d2400acd5836818b95e7b658cff
SHA3-384 hash: 79ebd4c82645a524ffd8cea7753f7991971ea99c596e7df2626b0ecfbcd9dd4ccc27dfadaeda3bfe422e32b2b83a64cf
SHA1 hash: 777086002de941f80e2379c9ff3849c7ad168223
MD5 hash: 9e58f18b05c5c6c0e1fb852a73729740
humanhash: yellow-golf-jupiter-wyoming
File name:SecuriteInfo.com.Win32.Malware-gen.12211.18162
Download: download sample
Signature Formbook
Create hunting rule
File size:742'400 bytes
First seen:2023-06-20 19:28:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:MmhGPM7q6bpw4dcZda/ig4V/LN5Hq07P2cRh0gtLEL/820JHvTCcUE1hGQIL2Oyl:Nzu4CZdOO5HDecz59M/8/ZRUkQQIi
Threatray 1'316 similar samples on MalwareBazaar
TLSH T176F41229116F692BC4161FB115057BB003FE5EE97862D3C70C9BBDD1BAEABED080152B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
310
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.Malware-gen.12211.18162
Verdict:
Malicious activity
Analysis date:
2023-06-20 19:29:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/aee64267-475e-465e-b9fa-bba7490ef50e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/401192/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.12211.18162.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/6491fdff9d44d31f835bd6ea/reports/ca279095-f154-452d-8aa4-d9ed1ca72479/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ed570698ccddfc346f65b5b86045d8af239e0d2400acd5836818b95e7b658cff
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b8e2b0b2-5193-42d5-ad6e-37b7f841a918
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1258614
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 891633 Sample: SecuriteInfo.com.Win32.Malw... Startdate: 20/06/2023 Architecture: WINDOWS Score: 100 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus / Scanner detection for submitted sample 2->47 49 Sigma detected: Scheduled temp file as task from temp location 2->49 51 3 other signatures 2->51 7 SecuriteInfo.com.Win32.Malware-gen.12211.18162.exe 7 2->7         started        11 YToWpqVtyE.exe 5 2->11         started        process3 file4 37 C:\Users\user\AppData\...\YToWpqVtyE.exe, PE32 7->37 dropped 39 C:\Users\...\YToWpqVtyE.exe:Zone.Identifier, ASCII 7->39 dropped 41 C:\Users\user\AppData\Local\...\tmp8894.tmp, XML 7->41 dropped 43 SecuriteInfo.com.W...12211.18162.exe.log, ASCII 7->43 dropped 53 Uses schtasks.exe or at.exe to add and modify task schedules 7->53 55 Adds a directory exclusion to Windows Defender 7->55 13 powershell.exe 21 7->13         started        15 powershell.exe 21 7->15         started        17 schtasks.exe 1 7->17         started        19 SecuriteInfo.com.Win32.Malware-gen.12211.18162.exe 7->19         started        57 Antivirus detection for dropped file 11->57 59 Multi AV Scanner detection for dropped file 11->59 61 Machine Learning detection for dropped file 11->61 21 schtasks.exe 1 11->21         started        23 YToWpqVtyE.exe 11->23         started        25 YToWpqVtyE.exe 11->25         started        27 YToWpqVtyE.exe 11->27         started        signatures5 process6 process7 29 conhost.exe 13->29         started        31 conhost.exe 15->31         started        33 conhost.exe 17->33         started        35 conhost.exe 21->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed570698ccddfc346f65b5b86045d8af239e0d2400acd5836818b95e7b658cff/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-06-20 19:29:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 37 (54.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5vlqnggm3x6di33fww4garoyv4rz4djeacwnla3idc4v463frt7q._file
Verdict:
malicious
Similar samples:
055d1353e090b0ca79f1cada52c20eea97a86f452af07d9300fdc2d906dde98e
Formbook
35a10de4741e23670aadd4aa19babf2ab5b8f134c0df0050eaf2255b6d90c053
Formbook
6689c58325956e0d5afe938fc8139589f85d44ff8733a6080c123eac34219e5b
Formbook
868c32e8f0d323bf24fbb9c6d073198cdb50a072905ba1f43f3725dceac6863d
Formbook
99002f0c1304f392fb93c48abc83bcbe88c42854c06ebebc77617912747b7f1d
Formbook
ad8413339b31fc3d1dced5bea0a98a95dcc5751108b4cf1553cf040c4a2159b9
Formbook
af6413eb92d567e09e0b113917c35ee7f801a9d13467d0b15f79f022f2680a24
Formbook
d6fc1cb115ba92328c7be966ad4a2f85c015555934898cadc108715aa4c8eda9
Formbook
ec879f20532ad2763f5b921c58e0231e542ae4f7d488aadf0fdddbaf14fa3569
Formbook
+ 1'306 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230620-x678hsdh62/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
63bf875417a4d14485debe930a5948b79f02b45bd9669c530e717d929bb8da99
MD5 hash:
f927688f7160b7a62052b1d3ff01d77c
SHA1 hash:
bb0924d0778ae7ca1992c3fedbc4f3a6301584cf
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/4bea2336-8c27-495a-b4d4-14bf9947e402/
Parent samples :
ad8413339b31fc3d1dced5bea0a98a95dcc5751108b4cf1553cf040c4a2159b9
46d5ad3a78bf9fe4f4799240caf67fae21f78c6d8a665e9a92719c0efec186c4
d53929503f5d9632f215cf24983b0b2700f10db634265bcefe2cd8fa4efaf2f7
e57990a97315ade20a7437d5c666851134167d95aa5b72c02cdb299a7202fa62
ed570698ccddfc346f65b5b86045d8af239e0d2400acd5836818b95e7b658cff
412c6188c1ab56d9a41bc91aa4b39e664ec9346a718a7ae9bf495618230d7c2d
b45f9e29351506203a4101b1559e928ec3de39850008d82598b8ce1c3a7a13c3
117657ffb63ef0b6355173babb3e4fd141dc8be775e2ef30c23953b6396f4f45
00d56f9d4e23372133f953d1a0bb58567bc2e9bc34f9e70304116a6382448458
713295015c5460b487bd9e9fbe4ac0e600791a47911852e5a5feec1bafbb55fe
SH256 hash:
f01a6fc735878ac63e8b5585179a21b4dea5d15b5c679ac90cbab1a9d36958cf
MD5 hash:
3532237c1316ef2cc8a39372a6b5f72c
SHA1 hash:
5cf317deeff0ce552c933c7d4e44ef3f5bd7746e
Link:
https://www.unpac.me/results/4bea2336-8c27-495a-b4d4-14bf9947e402/
SH256 hash:
bf30f7032a6e2fdd6a872718de569645dda2c9e734a4f90a77e5af9a58d75812
MD5 hash:
29432c0db5445ce74b8a1042234187af
SHA1 hash:
fdc1bce5c868fbaed48ff27b3cc73b752bc66e75
Link:
https://www.unpac.me/results/4bea2336-8c27-495a-b4d4-14bf9947e402/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/4bea2336-8c27-495a-b4d4-14bf9947e402/
SH256 hash:
bffae91357f6f855bfa35957658ea6922cce0ed61468c2037c09f00e56be3075
MD5 hash:
24cd46fbabfdedc5f56aa02602df5adc
SHA1 hash:
7a0a6645182dc840bbfd8f7a03ac58bbdb75678b
Link:
https://www.unpac.me/results/4bea2336-8c27-495a-b4d4-14bf9947e402/
SH256 hash:
217002e9b6f3f68175bb5242e5f169bbafa63a680ee106ea5934a83a5793c8a2
MD5 hash:
19e81eafafa98a4655c2771b5c3fa884
SHA1 hash:
0ecf8c5bf86692cd2b5078731cbc4fc23c015a7f
Link:
https://www.unpac.me/results/4bea2336-8c27-495a-b4d4-14bf9947e402/
SH256 hash:
ed570698ccddfc346f65b5b86045d8af239e0d2400acd5836818b95e7b658cff
MD5 hash:
9e58f18b05c5c6c0e1fb852a73729740
SHA1 hash:
777086002de941f80e2379c9ff3849c7ad168223
Link:
https://www.unpac.me/results/4bea2336-8c27-495a-b4d4-14bf9947e402/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ed570698ccdd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed570698ccddfc346f65b5b86045d8af239e0d2400acd5836818b95e7b658cff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/401192/

Comments