MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f362a8543a40e8bdc5bccda150334bdd2f53f4b169725b3522064aa27992d1c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | f362a8543a40e8bdc5bccda150334bdd2f53f4b169725b3522064aa27992d1c9 |
|---|---|
| SHA3-384 hash: | 1f21fa9232856148ec3be4cfdb04b9003d758681f6ed38ee7ebbea89d5144c4ddb11fd1e29935f0a1854cd22a1c2cea7 |
| SHA1 hash: | 20ad50236ae17787896bb41abb0c40356aba4ebd |
| MD5 hash: | 2608ea96bd6424120c20e6594827f844 |
| humanhash: | fanta-timing-four-enemy |
| File name: | 2608ea96bd6424120c20e6594827f844 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 780'288 bytes |
| First seen: | 2023-05-21 21:03:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:Uv5T+1qGAsuyVeaW2fbKrlN6sg+aphQXDoCIis/vx6UQov5/A:U1+1XRBhAuNjwoFisHx6UQ0 |
| Threatray | 2'953 similar samples on MalwareBazaar |
| TLSH | T161F4BE2061BD4B45E03E97F15AA8F92803B274A3A5FADA355ED5B0CB4A62F001F45F27 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
259
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2608ea96bd6424120c20e6594827f844
Verdict:
No threats detected
Analysis date:
2023-05-21 21:05:58 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
lolbin packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-05-17 08:07:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
27 of 37 (72.97%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'943 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:pr29 rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook payload
Formbook
Unpacked files
SH256 hash:
a5a130ea1241fc2fea8cd56aa75bbca78423e2e3478f4f0b8b24675695adebbf
MD5 hash:
75f8673d9872a2bb2585fb8a519bde32
SHA1 hash:
6f83b53b7abefcc8694575bcb44a70c6f73b1f07
Detections:
FormBook
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
e786999c3d8fca650c04038d0048c2ce70f644e0be3edf64955a8c35a43f4416
MD5 hash:
3d4a830338ca925dce47026b1f7f7b82
SHA1 hash:
d718dc806eb7988cf5a8e6cb19c8f9553a3b30bc
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
SH256 hash:
a7485443b331c2fca54197f53638cb11a8c82bac339b66f35b95d0ad0aceb438
MD5 hash:
dfca41d2838170cb07ef445bb7d9c987
SHA1 hash:
7622672bed23f065cafdf2a17879ebf5926aba8b
SH256 hash:
7ee54089bc11d33fbb3ce1190c1129455c5562f94e6bdd9063a012202787cc1f
MD5 hash:
ec0e28df3d591bb70938a23c8f39f935
SHA1 hash:
5c13389d18e92813e12ab8a68dfff6837b20ebda
SH256 hash:
f362a8543a40e8bdc5bccda150334bdd2f53f4b169725b3522064aa27992d1c9
MD5 hash:
2608ea96bd6424120c20e6594827f844
SHA1 hash:
20ad50236ae17787896bb41abb0c40356aba4ebd
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://171.22.30.164/whiteezx.exe