MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef5cc12819146a67c29bb28776868909815dcb9d41bac73afd68df8a8653028a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef5cc12819146a67c29bb28776868909815dcb9d41bac73afd68df8a8653028a
SHA3-384 hash: 7416f0668181c5f196d751afe4502c2ba833c2ef58abee2b82ec922210e770234e4533205726cb7d81debf995f109cea
SHA1 hash: 783ed571a82dd5e5e31d3d7234251c3c2e0b6917
MD5 hash: 0601533f80c67db850b92a8eac678f3c
humanhash: harry-burger-mirror-nitrogen
File name:JonnathanData1.ps1
Download: download sample
Signature Formbook
Create hunting rule
File size:465 bytes
First seen:2022-07-13 19:23:06 UTC
Last seen:2022-07-13 22:23:32 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12:s8AdjLPT27L87HGrdvhIW+4OiF7vQnD5j+CrBirmWIM0Jn:W/T27LmGrdB+4NF7vmD4GBsb0Jn
TLSH T195F0DC135DD15061825CC22FF45D870744D6ED09B6C6E1E0E9E08807EC02049C5BDE11
Reporter Anonymous
Tags:FormBook ps1

Intelligence

File Origin
# of uploads :
2
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62cf1bd4d6d93426ceead605/reports/4ea820fb-5125-47a0-8848-7043278721b4/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1030538
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef5cc12819146a67c29bb28776868909815dcb9d41bac73afd68df8a8653028a/
Threat name:
Script.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2022-07-13 19:24:05 UTC
File Type:
Text (PowerShell)
AV detection:
4 of 26 (15.38%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=55omckazcrvgpqu3wkdxnbujbgav3s45ig5moox5ndpyvbstakfa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat suricata
Link:
https://tria.ge/reports/220713-x4cntschh5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Xloader payload
Xloader
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
Dropper Extraction:
http://198.23.212.192/inv/oil.exe
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ef5cc1281914/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ef5cc12819146a67c29bb28776868909815dcb9d41bac73afd68df8a8653028a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments