MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
SHA3-384 hash: a180ba3070550bedfc247907a159f50771a98cc681bf8e9f971230931520cadcb848791c2776aaced8e4dabc7bfa8be5
SHA1 hash: 63adeab473d51d5b646e4c5159013b8bce13b985
MD5 hash: 26f39353ccf8794431815b8bb8961515
humanhash: east-east-india-mike
File name:FormPlayer.exe
Download: download sample
File size:2'344'448 bytes
First seen:2024-08-01 07:20:19 UTC
Last seen:2024-08-01 08:36:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 49152:GbyDiPevb0uowQbyVGy69zWYCFiWjN/v2y4D6ozfUZ3fdluI:GbyD9z0uxQGVGt1DFOn2Taf9
Threatray 44 similar samples on MalwareBazaar
TLSH T1BCB52301DBAD8EA1C0D439FA85430BCD43A4B70E343AC7EDAE493D09E929B571E766D4
TrID 35.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
28.3% (.EXE) Win32 EXE PECompact compressed (v2.x) (59069/9/14)
19.9% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.0% (.EXE) Win64 Executable (generic) (10523/12/4)
3.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon c8c49aa9acd6ea86 (3 x CobaltStrike, 1 x Arechclient2, 1 x BadRabbit)
Reporter JAMESWT_WT
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
321
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
FormPlayer.exe
Verdict:
Malicious activity
Analysis date:
2024-08-01 08:09:21 UTC
Tags:
evasion upx
Link:
https://app.any.run/tasks/91e6bd16-e0e8-4c2e-b408-155b1f9dad60

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ab3764037b02d0daece272
Tags:
Discovery Generic Infostealer Network Other Static Stealth Malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Creating a window
Creating a service
Using the Windows Management Instrumentation requests
Changing a file
Moving a recently created file
Searching for synchronization primitives
Sending an HTTP GET request
Unauthorized injection to a recently created process
Enabling autorun for a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin packed shell32
Link:
https://www.filescan.io/uploads/66ab3765dfa8b2fced50a3ac/reports/f254f461-43e9-4c47-8a80-795ceb174903/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6f44b517-d54d-4147-ad39-fb68f6c05dcf
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1485880
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Drops PE files to the user root directory
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Reads the Security eventlog
Reads the System eventlog
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1485880 Sample: FormPlayer.exe Startdate: 01/08/2024 Architecture: WINDOWS Score: 100 24 www.flash.cn.cdn.dnsv1.com 2->24 26 www.flash.cn 2->26 28 4 other IPs or domains 2->28 40 Antivirus / Scanner detection for submitted sample 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 .NET source code contains potential unpacker 2->44 46 2 other signatures 2->46 7 FormPlayer.exe 14 4 2->7         started        12 svchost.exe 1 1 2->12         started        signatures3 process4 dnsIp5 30 falshcm.oss-cn-hongkong.aliyuncs.com 47.79.64.190, 443, 49730 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ United States 7->30 20 C:\Users\user\nep.exe, PE32+ 7->20 dropped 22 C:\Users\user\AppData\Local\Temp\setup.exe, PE32 7->22 dropped 48 Drops PE files to the user root directory 7->48 14 nep.exe 16 2 7->14         started        18 setup.exe 243 7->18         started        32 127.0.0.1 unknown unknown 12->32 file6 signatures7 process8 dnsIp9 34 mstsc.l5.cm 47.76.188.34, 20088, 49733, 49746 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ United States 14->34 36 api.ipify.org 172.67.74.152, 49736, 49747, 80 CLOUDFLARENETUS United States 14->36 50 Antivirus detection for dropped file 14->50 52 Multi AV Scanner detection for dropped file 14->52 54 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 14->54 58 5 other signatures 14->58 38 488928.ovslegodl.sched.ovscdns.com 43.152.29.72, 443, 49734 LILLY-ASUS Japan 18->38 56 Detected unpacking (changes PE section rights) 18->56 signatures10
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-06-17 05:35:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
415
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6uxnnpeakwc5t2a3cwrsplz6zpgmm6vmdag76vmwrnitga2445gq._file
Verdict:
malicious
Similar samples:
1eb83f805c41a946b3cf639512ddfe1da13fce7aca90270448f1b03c343befff
355b1016bf7b291b5a4fcf708949671eb88e053f49390f4189415c627ba948bb
468d71fc7e7a6d72d51c2f61f6463d625ef29fe3b90198d3b6cc3cf892d24301
b59e827b78d5acbcaa7043eead3dab39926bf2a0f79725831cec90e78962de0d
c513dde23b6e4d4274696e7598f01f0bc96953ad14556fb7de24c765ab574327
e8d6393b63beba6b6cad43f7068f597f9a9c89effba80917412c3f438214ec5c
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/240801-h6pnvayekj/
Behaviour
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b46821b4-47ff-4904-bd69-907c1c414677
Unpacked files
SH256 hash:
467f6766c0fe82abc9286b530d7fa455360c8c7f20a7f28461c54873e4e4de21
MD5 hash:
6be622c4fd3a217b3f45dcd0b1897ffe
SHA1 hash:
0d31265517b835028a81eaf4e16dd3b60d4bc874
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/2783877d-6ecd-49e1-bb3c-1117fbd194b1/
Parent samples :
e8d6393b63beba6b6cad43f7068f597f9a9c89effba80917412c3f438214ec5c
1eb83f805c41a946b3cf639512ddfe1da13fce7aca90270448f1b03c343befff
c513dde23b6e4d4274696e7598f01f0bc96953ad14556fb7de24c765ab574327
f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
b09326eda96f66176f54837d11d485a281dd89f24addc68f2c1e5cfedffe90e3
490c76da1ec8a15a782850b4468cc7ab780ce8cc436d7b490c280588864940cf
363e545ebbeb5eafa15f17986c7e90abebe28774b7b4bb2c1fcb2ff64c9158b8
021cdda10106e4db66873cd411ae3ea1d63ce01a0de1889f658d73c84ea00c8e
68ad2b97e4e2c2e2dedd7b7cbb3a0483c09948513f849bcd22ebeee1f8f40cd3
797c029eb74037b438d4c8eebc774dd45c243e86570d0a2118b168ea7472ca0d
a3ee42d49a63d91f51e144c2372002385da3573c8179ed743eef439904a6cdf4
55d421ed6221bf7cb9cfc4a78c3b7dd8407f19933fd26af3adb4f659bfe81abb
3803477a8eaad24fbd1fb71245a009f371eab35186065534bb14ae5dc41f8e4b
e88a142edb195e0d7e73616f3f5edc8a8ae6fd811c2985ac591c0925122ca8ee
66a517357eb8d9d77f8e4f1e67bcb3d3ad36b95010ae2a47caef8fe9018bcfe6
0916b368912885a4b72e1f309de846041bcbb3b74e478964f11797f0e4ace419
4c5b6f817e37e530c3440d02fcfd808aaef1e15f880fc9cdb43799ecc86bb1e9
d0d9d1a383cd3123e3a740793e4e9dab17701dd26856c3d13bdd84aa9b6f3c44
0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2
5783db0ba968957f967255d34b62546fdd3f6e70aa65b2b3fae44228bf6441ca
SH256 hash:
94bf4afd3a77d76311159daa2f19643a7f7d1e2c4b37807651b328feeef34668
MD5 hash:
1115be7832a7fa6005cb06aa20cdbb5c
SHA1 hash:
d0cf4dcc15749f031b4f5631bd603daf3bae1696
Link:
https://www.unpac.me/results/2783877d-6ecd-49e1-bb3c-1117fbd194b1/
SH256 hash:
4bf1f7ab15b8a636248aeaf26a9c51ab5478d075399632114334f0911caa18ba
MD5 hash:
628ca44a0da32146d416661d09a2f444
SHA1 hash:
bd6b90425785fddc251aa09db4656e63c19a558b
Link:
https://www.unpac.me/results/2783877d-6ecd-49e1-bb3c-1117fbd194b1/
SH256 hash:
2fd2620e4eff83a2c7590ff6bd46b6b1657d4b567f1b7ebf392990ccf9b80828
MD5 hash:
7497dccc07365763b3ac314c11cefbec
SHA1 hash:
a548fef0cb02a3427af8cf492dc6a1b3ce8fc875
Link:
https://www.unpac.me/results/2783877d-6ecd-49e1-bb3c-1117fbd194b1/
SH256 hash:
7a55e9246e66353d32c2214920e5976fc5ac77f94aa3824d12a9289362ea425d
MD5 hash:
e9bbfc471c310ebba367176108b35004
SHA1 hash:
a0498fb9a661cff500cfe415cadb7bc6d0f3edeb
Link:
https://www.unpac.me/results/2783877d-6ecd-49e1-bb3c-1117fbd194b1/
SH256 hash:
f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
MD5 hash:
26f39353ccf8794431815b8bb8961515
SHA1 hash:
63adeab473d51d5b646e4c5159013b8bce13b985
Link:
https://www.unpac.me/results/2783877d-6ecd-49e1-bb3c-1117fbd194b1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PECompactv2xx
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high

Comments