MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ef5f84a6608bc85058740063ba211f2d7da26883266aed349531c9678d29d55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ef5f84a6608bc85058740063ba211f2d7da26883266aed349531c9678d29d55
SHA3-384 hash: 27a0c8c1dabb34470c839ba673a3d27e1693bd72e12ea6be093ad4d01765cd8fd5d521aee8aeef8beb8ef1277eadb5a2
SHA1 hash: ba333e8fb7f0adc1ae73475da631fa76f4f2cd14
MD5 hash: c70328d18cf888e5bf5a17985bff4de6
humanhash: california-sad-mike-west
File name:makina.xll
Download: download sample
Signature Formbook
Create hunting rule
File size:566'784 bytes
First seen:2022-04-14 05:47:49 UTC
Last seen:Never
File type:Excel file xll
MIME type:application/x-dosexec
imphash a31761b5a590c4c499d5f4a347d75c12 (23 x Formbook, 17 x AgentTesla, 6 x RedLineStealer)
ssdeep 12288:Vn/zDvGHAykHSzLW/4+8bzbBSreMdpEgFK/UqW:ZzbGHAzHAjX13cL
Threatray 115 similar samples on MalwareBazaar
TLSH T127C48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F
Reporter abuse_ch
Tags:FormBook xll

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
makina.xll
Verdict:
No threats detected
Analysis date:
2022-04-14 06:06:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/803b7021-d4dc-41c1-be6d-4e39d11f7c14

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Artemis4EBC548DF517.17970.15145.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Office Add-Ins - Suspicious
Link:
https://app.docguard.net/0ef5f84a6608bc85058740063ba211f2d7da26883266aed349531c9678d29d55/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed packed
Link:
https://www.filescan.io/uploads/6257b5a1eab80a7a6c103325/reports/6cc744be-464c-49ab-8991-5d80ea97d4b4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ef5f84a6608bc85058740063ba211f2d7da26883266aed349531c9678d29d55/
Threat name:
ByteCode-MSIL.Trojan.ExcelAddin
Create hunting rule
Status:
Malicious
First seen:
2022-04-13 09:43:49 UTC
File Type:
PE+ (Dll)
Extracted files:
3
AV detection:
20 of 41 (48.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b327qstgbc6ikbmhiaddxiqr6ll5ujuigjtk5u2jkmojm6gstvkq._file
Verdict:
malicious
Similar samples:
0c425d6c6bce93fad4f32c275db574e8b3161a1ae55a9a957d50020b516d3e2c
Formbook
1c7e66126306537a453d7a792978464aa8ad5ac2f34bd1fccfffe7e0b9c6d85c
Formbook
226626815bd89794755b446ad9ab17aed9287f970e5aed3d184dc34e1ec34e8a
Formbook
2d9035fccfa410259c75bb54edc9c95c2d736e6bdf87832fc2062dcd89286b39
Formbook
2f617a71f3eaab15248aa9a964c464e71d8ec784417e79c38b5951ddfa39c2de
Formbook
30980176792fc176767dfd338ef7fd0b73f04b66cd63e1e3b0bbf485bc064ed4
Formbook
5f1beab27690a8ea9b9be78c5d34dd852dd3af4f5128feace84d1b2e10d73b59
Formbook
676ba4f2375a2e7c7dcd4949090db27254ddf06d5d8dc6ef88072ebef8a97784
Formbook
b2991de24bb7a821f3baf980d08ce4bb3d6bd851fefe846147a563340d398d73
Formbook
e0a8a096299e8b28d1166af3321045635294e03227d45515f5c48f4fd38e943b
Formbook
+ 105 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:o24i rat spyware stealer trojan
Link:
https://tria.ge/reports/220414-ghfwcsggfr/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Formbook Payload
Formbook
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ef5f84a6608bc85058740063ba211f2d7da26883266aed349531c9678d29d55

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments