MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26ed54f0d441f0f3dd744f03f30d8f1fa01de0ed267df7b7fec4c9b2eab742d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26ed54f0d441f0f3dd744f03f30d8f1fa01de0ed267df7b7fec4c9b2eab742d2
SHA3-384 hash: 2afb004da2496e15c5d311b1e4f32b60723eb3ac1f462e7fa3074ec37d824c796de190561b5d760f85016d460b12be67
SHA1 hash: 5ea4adbd731bbfb714a0752f73d53b4cdc56f7bf
MD5 hash: dd6870f07ae1a48debf44d7a9b81e5f9
humanhash: wolfram-minnesota-papa-mirror
File name:sipariş formu_831519.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'006'592 bytes
First seen:2024-01-10 09:55:22 UTC
Last seen:2024-01-10 11:16:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:BPy6sURsQfLmj/L0roQQtvXJSy9uovfL/sf/:BPSURHSzL0wtXJbL0f/
TLSH T17B257ED1F194889AEC6B09F1BD2BA53024D3BE9D54A4810C599EBB1776F3342209FE1F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter abuse_ch
Tags:exe FormBook geo TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
344
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/26ed54f0d441f0f3dd744f03f30d8f1fa01de0ed267df7b7fec4c9b2eab742d2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MSIL Injector
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e6f3f3dd-7838-4439-bf15-de9e715fdbbf
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1372330
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1372330 Sample: sipari#U015f_formu_831519.exe Startdate: 10/01/2024 Architecture: WINDOWS Score: 92 22 Malicious sample detected (through community Yara rule) 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected FormBook 2->26 28 4 other signatures 2->28 8 sipari#U015f_formu_831519.exe 3 2->8         started        process3 signatures4 30 Injects a PE file into a foreign processes 8->30 11 sipari#U015f_formu_831519.exe 8->11         started        process5 signatures6 32 Maps a DLL or memory area into another process 11->32 14 KLkOCPwhBzCnQXLoLYipjmtNzib.exe 11->14 injected 16 KLkOCPwhBzCnQXLoLYipjmtNzib.exe 11->16 injected process7 process8 18 WerFault.exe 21 14->18         started        20 WerFault.exe 1 21 16->20         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/26ed54f0d441f0f3dd744f03f30d8f1fa01de0ed267df7b7fec4c9b2eab742d2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26ed54f0d441f0f3dd744f03f30d8f1fa01de0ed267df7b7fec4c9b2eab742d2/
Threat name:
ByteCode-MSIL.Trojan.Remos
Create hunting rule
Status:
Malicious
First seen:
2024-01-10 09:56:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e3wvj4guihyphxluj4b7gdmpd6qb3yhnez67pn76yte3f2vxilja._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
agenttesla
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240110-lycabsebd4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
a99197a2e3f477d15802a9b2250a01f7cd2be8ed435141a4e280307f2a7f2b7a
MD5 hash:
9ac50796df27f8b3977d71000d15927c
SHA1 hash:
dcf769debf4522b0800188ab9cbef26d1dbe8aed
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
59c509b8e3778b013ec436fe2663feb2252963c95f2dd171a3aad64363c9c4da
MD5 hash:
347f1a104ebe1050b00056044974b9c0
SHA1 hash:
f767c69f88f32e75ef81efc2cbefed8c619954ac
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
d8e77edad3cd36f3e1df5896cfa4b9f40392ff82009a14ef323d489b9a817462
MD5 hash:
41028b7149f7438c3920803908e109b8
SHA1 hash:
9de4b2bfa4f4d3f6480ac766c4089026b65185ff
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
21afe82a0b71ee589c26f32dc88e0a6e22817f21194b2a83f1807c6cecc8c818
MD5 hash:
440bb4db146ccb1161ac2bcf365d7676
SHA1 hash:
506eda511b46df6e95d86861e70fda81307f8623
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
21a51d370452e08a44399891ea781b14dbb7f9cb643a5e20f78843af27bd2171
MD5 hash:
dc8ac9f7f3fe5396182b639ba0876918
SHA1 hash:
dd6c36e253a068767f32cb770ef6b16e21e0176c
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
510a5ac99006dd3e53b933bff1d7049b02f1f937efd4616289c268ec52682ffd
MD5 hash:
27841bf4052e421b836b1a6f3cb59f31
SHA1 hash:
6c24d0db8fc21c9dbdb286dd4fc7f483e6af6edf
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
2c8ee23c130854715223fd16d1ab10f25d262c020c3d78c3f88b374a7e7e2fed
MD5 hash:
07f835d86c6a47e24f34d0ae7d8e72af
SHA1 hash:
6af9fb6ddbc18caaba6e7d68c5c1a2782b3c2a2b
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
8ca8d59451ea5998d1cf8f12dd91853f67932f9655ec11e2327c0281ccc2cc89
MD5 hash:
76ace7c0a50993cd0995c083a31f891d
SHA1 hash:
4b3f6c1768161f6391bbfdff75b1bf0656e47fb3
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
937cf70aaacc07924a93896bdefa7223552710e2c0c4dc04afd1f940b37d07eb
MD5 hash:
79f95149b280602e1d224dd2ffade33b
SHA1 hash:
2b8618fb4433dda73e0e6e50f69985d4e18ba621
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
4c25e9ebc8b5955273b3a70203c93d0bc3dbcad2026e21aacdfa0a3d82da619b
MD5 hash:
eea03800d78f95980463fc09b4ab9c78
SHA1 hash:
11542374abd65ca955d3ed30fee909849e5d1378
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
SH256 hash:
26ed54f0d441f0f3dd744f03f30d8f1fa01de0ed267df7b7fec4c9b2eab742d2
MD5 hash:
dd6870f07ae1a48debf44d7a9b81e5f9
SHA1 hash:
5ea4adbd731bbfb714a0752f73d53b4cdc56f7bf
Link:
https://www.unpac.me/results/372e10f8-94c7-4234-872d-4e2d66ee3c4f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/26ed54f0d441f0f3dd744f03f30d8f1fa01de0ed267df7b7fec4c9b2eab742d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 26ed54f0d441f0f3dd744f03f30d8f1fa01de0ed267df7b7fec4c9b2eab742d2

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments