MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02
SHA3-384 hash: b36719b42deb9b661717e7c32497cc448a70b25f5d2bf055b832337af687e1654a46c9d60cc07f151c0762f627fc24cc
SHA1 hash: 995a5470e23ff05abb858bb8835bbfc3c4893386
MD5 hash: 455f0aa8494246196c4831d75ef43f77
humanhash: glucose-golf-berlin-oranges
File name:DEL-25-7-23 COS-HWB NO 65534423333.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:709'632 bytes
First seen:2023-07-25 18:35:57 UTC
Last seen:2023-07-26 04:56:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:gXPZwn1kTm1zuBZWgODGW8gJWdTk+1XkDIjG96MdF59tJCf0xDvdKHAEQ:7d1zuKGWoRkDkU6ellt
Threatray 3'407 similar samples on MalwareBazaar
TLSH T18BE4F01372EC46C7D0AD1EB52C55F30C0AB6AE665521DE096E89FACA5C3170215F3A3F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon e4ccccccd4c4cccc (10 x Formbook, 10 x AgentTesla, 5 x Loki)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
305
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DEL-25-7-23 COS-HWB NO 65534423333.exe
Verdict:
Suspicious activity
Analysis date:
2023-07-25 18:42:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0bf5dfe0-283a-4ac5-b53d-e64f0d1e471d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/433111/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.1420.28169.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
clipbanker comodo darkkomet packed
Link:
https://www.filescan.io/uploads/64c016142c2ccb709447fb91/reports/bd3ebb64-ae3c-49f0-a481-5bb1487530fa/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/416cf0ad-ee49-4857-9fd3-32190c46f987
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1279464
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-07-25 16:01:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cjlxe25k5storqaaibwovoroy4h2km3r2my7rzvttp77roykhiba._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1d8ffbf2a386718acac9f307a0b0315be1831b7a3407aeed7cd4b510db02a72c
Formbook
6a0e5686e8520c9c1e18923e464e92ebe6d32ee4219c9d1ae71215857f917b0a
Formbook
9202b35448e653781c1e8d04a5f1266e40116832675be9b096034f4e0861c78c
Formbook
9cd1b016ff9416679f96b8047284684816dc8dc5c61d698f2ff69a3d200477ca
Formbook
9e6e021c6deed0f7538b92df6a47667f2c52919628fa4886c6948860720f9214
Formbook
c0bd2ff7157746e5ca7b325696c5c2d8c4258b205fe8789763d4a923e012c986
Formbook
c48c1d65bf3e58d5dc4b9876db6da4d90e93ca74b4b51cd35c7b7400d691c182
Formbook
fa89c3083bfde83eb9d216c5e303d1c1b1e21020501da5f7cfc1ff167cd2216b
Formbook
+ 3'397 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230725-w8w3laff7t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
8b14ddfc9e7a125693eb61f245cd254dc665c907d77cae050718e5b622260237
MD5 hash:
5453fa81bf6d8dcb2e930af5f721ea1b
SHA1 hash:
1ad534a06736f927e9d39d86112719cd2a24661c
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/8d8ec04a-f412-4225-b432-129c865c03e7/
Parent samples :
6a0e5686e8520c9c1e18923e464e92ebe6d32ee4219c9d1ae71215857f917b0a
fa89c3083bfde83eb9d216c5e303d1c1b1e21020501da5f7cfc1ff167cd2216b
c0bd2ff7157746e5ca7b325696c5c2d8c4258b205fe8789763d4a923e012c986
1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02
SH256 hash:
4ea7d1a12876b7541aec2f41c3fe6ef7cb7d1ff7e938c7163e892a8d6ac11e54
MD5 hash:
fb3dcaa76207448c71daba69b5f00f52
SHA1 hash:
8c0665531dcd4a540b2fb953ed896e54736a63f0
Link:
https://www.unpac.me/results/8d8ec04a-f412-4225-b432-129c865c03e7/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/8d8ec04a-f412-4225-b432-129c865c03e7/
SH256 hash:
1bf69033e97a8ad8d59469dd2f1aa57bab7461345e9993acc83afa48029c95ac
MD5 hash:
58419415321b3303da79fcd299874125
SHA1 hash:
a7a4c4fb47ccefd232a543219e2f4e0e12520912
Link:
https://www.unpac.me/results/8d8ec04a-f412-4225-b432-129c865c03e7/
SH256 hash:
7f181c4920d37759ec42ca3c07493b0fd824639858d620848715f577d97d366f
MD5 hash:
55b00d988261bdd201c43989aa0fa16e
SHA1 hash:
8f204f8b1ffa479f3969036b2021507280c89f74
Link:
https://www.unpac.me/results/8d8ec04a-f412-4225-b432-129c865c03e7/
SH256 hash:
1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02
MD5 hash:
455f0aa8494246196c4831d75ef43f77
SHA1 hash:
995a5470e23ff05abb858bb8835bbfc3c4893386
Link:
https://www.unpac.me/results/8d8ec04a-f412-4225-b432-129c865c03e7/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1257726baaec/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 0a9fc37c5b5c74d7d823f9d22317f5675faf8fb5a8fb97272138c1593ee5f518

Formbook

Executable exe 1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02

(this sample)

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/433111/
  
Dropped by
SHA256 0a9fc37c5b5c74d7d823f9d22317f5675faf8fb5a8fb97272138c1593ee5f518
  
Dropped by
MD5 e30b322c2c288f32bca17d8e7c74c2a4

Comments