MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4
SHA3-384 hash: d0399052c0869adbed85917c9b71ea5dee8e1e64b81323807c46c60b26c63c6e9a39847492626a9695aa5f0a98b5e1cc
SHA1 hash: 7269760183b1238433857cb7b6f96b1817f5daf7
MD5 hash: db38d69e18e49ae2f8531abe8988561f
humanhash: mike-foxtrot-juliet-iowa
File name:0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4
Download: download sample
Signature Formbook
Create hunting rule
File size:192'000 bytes
First seen:2023-06-19 07:42:16 UTC
Last seen:2023-06-26 08:01:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:xWoiYbXycDYqzcvxDbZdLNDy2v9/tL34duyZlMIVaHfEgUYcJlcpV0U6tJwg:c0Xt8qzc57htT4dgeaHfEgUYcJlc763N
Threatray 2'952 similar samples on MalwareBazaar
TLSH T19C142361438D881FD02A2278562EB4ACB3955FC364FA5315C03F07ACAB6F6A5C421F7E
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
263
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4
Verdict:
No threats detected
Analysis date:
2023-06-19 07:51:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fa20e91e-c08d-4f52-8977-218eabc14f9a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/400321/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/649007075f4ad0cf05684ebf/reports/e6c0a724-13a6-479c-94c4-205b283eaf52/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/769856a7-5b81-4a15-9795-9fa50483ec36
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1257827
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-06-19 07:43:05 UTC
File Type:
PE (Exe)
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bzwaom6rjcw6r44yppqcausart6dxgbqrsslfgk7glhhxlqgwksa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
07ad0c61940072d3f26c6706e550f970c2e3ee59d1b0a519515ebf16e013b11c
Formbook
1568ed9366bd6a4dfaa68fb2dd6bfe64029f379108ca2975ea18de63e70b90e7
Formbook
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158
Formbook
6df873769694ef3980e2e19d8c657e4d993938b9c9ee8912a95f83027f1a2ea0
Formbook
7417cbf823e1318517ba9b0f02ce10a5b75cd778cde237dc4e4f32f385521617
Formbook
7517367b3b61170bb7637de6f89077069159c4a04f430c28102e2d7cf5a0343a
Formbook
7a91a1cbaa20e78c0e6814b51ed7d239074c95dd348159817e16606a6a04f344
Formbook
84b41f626786ed7a54e2fa20578126a1865c4b070242df9a535178d576a6ca91
Formbook
af6413eb92d567e09e0b113917c35ee7f801a9d13467d0b15f79f022f2680a24
Formbook
e904274bd2e5d919c63c6db8c82f908abc10d65fdba772596e2953ab708b1726
Formbook
+ 2'942 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230619-jj8zmsdf3z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
f0048516d6a1799fe717d685e90915e34e8ce6e2d9557414e7958d215fa13ea0
MD5 hash:
dac310d44ca6830c519e0ecf5aaada46
SHA1 hash:
5a49db03d3b5456f453e9424a83d098bef7e5cb4
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/db3906a0-d06b-4271-adf5-f73b17d511eb/
SH256 hash:
0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4
MD5 hash:
db38d69e18e49ae2f8531abe8988561f
SHA1 hash:
7269760183b1238433857cb7b6f96b1817f5daf7
Link:
https://www.unpac.me/results/db3906a0-d06b-4271-adf5-f73b17d511eb/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0e6c0733d148/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/400321/

Comments