MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c
SHA3-384 hash: 7526ba650b7dfdc22c3dc2e1007394d2feeedaa6d30cbdc55f2b0b870fdd304f43d5e33e652fd4c6e2157a784f7ce9ae
SHA1 hash: b71a03a87cc12ad4cd7f2456a254ebdc120d277e
MD5 hash: 9e07e82773ce214334e2f6db415a70fb
humanhash: kitten-violet-river-finch
File name:HSA - Karuma (30 Oct 17).exe
Download: download sample
Signature Formbook
Create hunting rule
File size:701'440 bytes
First seen:2023-05-22 18:19:14 UTC
Last seen:2023-05-22 18:39:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:otMx0YPX/NqPs7H4GNaEYF56cn0luv1Xv6cvOpS0a9cdJWc5EvJ27y:ot7HPs5ih0lP6cdJfavJY
Threatray 2'912 similar samples on MalwareBazaar
TLSH T17FE4F1C126D88D45E5AB9EB459A3F2344375AC65EB27D30D24F06C8B7CA2B813B11BC7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 224472b2a0c04280 (13 x AgentTesla, 10 x Formbook, 8 x Loki)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
260
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
HSA - Karuma (30 Oct 17).exe
Verdict:
No threats detected
Analysis date:
2023-05-22 18:26:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c14de2b3-0c4b-4d27-8f0b-0ec668aa04f3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67164460.17066.14559.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/646bb2560b148f6d8bcb3d7b/reports/b1ec8820-374c-4b9a-9d40-5a86605b0fb1/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/03e56a1e-78fe-4135-8f97-b7fabc3f0437
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1239953
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-05-22 04:45:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
23 of 35 (65.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cupkzmtpmuix2sskxochhsdfb3oufmdzuzrppxcmj265szqeluoa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02bc9f274f7ba4ec93358bfa71c5b658727b414e7e6301c50fac619227a78327
Formbook
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
Formbook
1950034453da28649135d35016d5ab7ee791cd4bbbc1e4a72f7c56ce3aa9dd9a
Formbook
2484f3b9e112f39471b0375d98ac190b4ffe3e29a295bcecdb8fd7b71af0094b
Formbook
362365797a625ef308f4071bc408a35c5cf5db4c2e6847bb854b995eec8e658b
Formbook
47c74b216015a03abc6bf2a786c4c760fe23f5ce920c9a0ed6e68aa340568e84
Formbook
6371e6f808e46f98c8d2e98d1a81203dc6ec3aa755ee5e61bee436bcfdb92cbd
Formbook
abbf85558290e3fa302f88f51243e5216f24c9bc4fce64a0f616db3be2c46e8e
Formbook
c918d1ae4c1635db9333c72fa06a6b04afa4a2ab37f494cd24c5e3fbc6963ead
Formbook
e8f271e2c00c7310ba76f5be24f425df7b4c3fdd84a0b715906a10da4f7e879b
Formbook
+ 2'902 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230522-wyrp5acf6s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
7bb70d3d4bc68aa15e8a93d035dc943e4860b944bba5767c8051738d6ceac24b
MD5 hash:
b3f6e6eb60ebf84ae5ad1f9926ab3ce9
SHA1 hash:
6c21c05971f62955fd3fbc2697c0407647224ee9
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/3763dcdf-d2d6-4a88-ba87-8ed574dd774b/
Parent samples :
02bc9f274f7ba4ec93358bfa71c5b658727b414e7e6301c50fac619227a78327
151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c
ce3a332225a10d659e26a1775a2e002ce62d470c9f02c47bbbf69767c7e2ffa9
571f10fb2f8ed39463e85d4a5af98f8203489b60d7a634d890462f10d6b15f2d
2692c5fb278a85db144c8121617ab7909a54281e5161b8bff920bd485ea4eccf
0b7841ea5b8040d0a636dfb94f374666baec80ee31307dc156c947b287d8f1cc
a9e9a756fe59beb18eb1cdfceee2b2c5c9246dfdad6dc05a6a9a810c479e2516
89525d55fd73880fae8d04629ee885c441a497fb091eb73e204c91d9d03ddb05
742d71604162b05306e5701394815bb970efa39a9778ca3cc7a1f6617845782b
SH256 hash:
ee8044463d637bca6ee6967b5ab0ab04d28db515b94e1e09eb931f69d4bb4d22
MD5 hash:
bf2ac64a9f5788fbb6acd96d2a3391d5
SHA1 hash:
65a983320eee0701a12db8b79729d99ff2e64d17
Link:
https://www.unpac.me/results/3763dcdf-d2d6-4a88-ba87-8ed574dd774b/
SH256 hash:
bfba2e78b36bc976fb55b5fd4355568f49d10e8302b9c0fdcff6d1c932607a61
MD5 hash:
8da6e9f3572aeec972caf8f88cb931ec
SHA1 hash:
fbe7fd306ef079509f143144c8bf5108f389a5d1
Link:
https://www.unpac.me/results/3763dcdf-d2d6-4a88-ba87-8ed574dd774b/
SH256 hash:
4c7ce432433fc3a8b0a33d558e0041d3f1c222224c5e61f33104d990a534c7a4
MD5 hash:
e8d756b4e2de5a67446e0b1b80e1bb99
SHA1 hash:
b664448f87ac044a16706d35e5d76538ba79508a
Link:
https://www.unpac.me/results/3763dcdf-d2d6-4a88-ba87-8ed574dd774b/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/3763dcdf-d2d6-4a88-ba87-8ed574dd774b/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
5cc53136c029036e16cbc2c28a7c9ef95b7ea03eaf12e86b7b62d076eb648841
MD5 hash:
46bdfe011b3dcbb4e944ce7dce96a1fa
SHA1 hash:
17eb2930e581e888d6e2c8cf0c568c4b1040c8a5
Link:
https://www.unpac.me/results/3763dcdf-d2d6-4a88-ba87-8ed574dd774b/
SH256 hash:
151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c
MD5 hash:
9e07e82773ce214334e2f6db415a70fb
SHA1 hash:
b71a03a87cc12ad4cd7f2456a254ebdc120d277e
Link:
https://www.unpac.me/results/3763dcdf-d2d6-4a88-ba87-8ed574dd774b/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/151eacb26f65/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments