MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26ee13ceb4c1b409a14de72d0cf8e1f3b0cb4d92a416b8618cff800df7762fb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	26ee13ceb4c1b409a14de72d0cf8e1f3b0cb4d92a416b8618cff800df7762fb1
SHA3-384 hash:	48e887c2a180b75da69ff214feffb5af732a4078c6031e2a3c22cc0b7d0c2ef2078d421e9096fba66e3b792f8823722b
SHA1 hash:	c27b7f385ccedc80dcaa6260328be47daaff37bd
MD5 hash:	7154feb284bea623eaea7e5320d69567
humanhash:	texas-saturn-south-triple
File name:	new order 00041221.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'115'648 bytes
First seen:	2022-09-19 19:36:29 UTC
Last seen:	2022-10-07 13:05:48 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:xiPIodcADqjJ5n6oSCwlWQMO2oGE72j0HRkPNY+8Vjt0Kao0Va9JO1+tOeOtqTHR:xzymjr6DCwlWQMO2UUloP
Threatray	14'445 similar samples on MalwareBazaar
TLSH	T1E335276835E6329EF467CAB68FD87CF5DE56F572031BA1B3506302498B1ED46CE900B2
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	James_inthe_box
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

289

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

new order 00041221.exe

Verdict:

Malicious activity

Analysis date:

2022-09-19 19:38:01 UTC

Tags:

formbook trojan stealer

Link:

https://app.any.run/tasks/546b77b1-9b4e-48bc-afa3-ce3a548313f5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/311454/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.42183.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Creating a file

Сreating synchronization primitives

Searching for synchronization primitives

Launching a process

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

83%

Tags:

fingerprint packed

Link:

https://www.filescan.io/uploads/6328c59c6aa625318dca7283/reports/48c74433-1180-473f-8955-12447cedb92e/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c3509b1e-ca1c-41f4-bc43-061bde0fb141

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1073239

Signature

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/26ee13ceb4c1b409a14de72d0cf8e1f3b0cb4d92a416b8618cff800df7762fb1/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-09-19 13:27:43 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 23 (73.91%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e3xbhtvuyg2atikn44wqz6hb6oymwtmsuqllqymm76aa353wf6yq._file

Verdict:

malicious

Label(s):

formbook

Formbook

240af737f08b41b9fb0b540653951b5b9b7c4459ad86a88e1ee33918f757f573

Formbook

4b0c9687e2404152643dbac78f4adfd8350095b9d465cb64b60de1ff70d3e651

Formbook

4d68f6c2e2749ddd3efe5802b9818ac3c183d6a8ef3613199a7678a83000c112

Formbook

8277159c5821b9c8c699fba65eb77532da18b0de22d6052d0fdc3377f9732fe4

Formbook

a139b8fab8e24344af7b4f5a261440cb81449a71449e20e1ab16abdd4e35e909

Formbook

a88e5d5fb17e50a25cf6dfe2512fc45cc3f712dccccee2d08ee7d1dac7086e5e

Formbook

bfac76ed38d1b5d2737a76ce7c59f1651040d11c1ec63388364e4cd37cc4fbee

Formbook

+ 14'435 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:gski rat spyware stealer trojan

Link:

https://tria.ge/reports/220919-ybsp1saafr/

Behaviour

Gathers network information

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Formbook

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/08e81f97-656b-4d48-8a73-67729c52094a

Unpacked files

SH256 hash:

5ac02f9abe3b1262391f7afd9f98bf12d6563ee4573541543325efabdb8a4ad9

MD5 hash:

40d864607e4e2320b5d9ba501ce55d76

SHA1 hash:

539fe585d996159e4042c5927438a8aa871135a3

Detections:

XLoader

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/25d7b1bd-64e2-48c2-bf3d-65232a4b1e1b/

Parent samples :

26ee13ceb4c1b409a14de72d0cf8e1f3b0cb4d92a416b8618cff800df7762fb1
e7ec471b7564c94d45aa5524f4205cfdc38f60965d5052144e667a643c543895
a0b19468a7896874e57b014b28e8d3abd1707e2b52a8ef1bf516d4c1a76a7b42
e963c5f4f3d85c3b4ca97d11584940a9a499e7fb89348a8cb4f54ee49ec375a4
cee39c6232758ab3a4fee85e0cb63cc70e7247e2afc8e52e440ceb4039eee90c
96c2f6719306e60120f214c54417de3819cb61d1a6b80bbcd177be659beeeacb

SH256 hash:

264e396c8f72224deb3cd6aa6337f75fd5264307b7a0f9bf67176885c0ca307e

MD5 hash:

eb2e990cfdca07815bfb34e63d437494

SHA1 hash:

32b4f5f78b6d168c20573563e067a835d46955b8

Link:

https://www.unpac.me/results/25d7b1bd-64e2-48c2-bf3d-65232a4b1e1b/

SH256 hash:

6f5788bd48e07f7b02759be535a29fc6575568fa7b2cdf36bc4e3f805bfa42be

MD5 hash:

819a1865aba89a50c1d926ffce719bec

SHA1 hash:

c0c1a7a058064229c5a10aeefd1b37a1bf20592d

Link:

https://www.unpac.me/results/25d7b1bd-64e2-48c2-bf3d-65232a4b1e1b/

SH256 hash:

4f80ddfe49b270f801ab44aa899153bbe2a0fb93abed0f9fc992f74ff6ab4fde

MD5 hash:

f4ba8570299eabf8fe2d02cc1dc0606a

SHA1 hash:

5d7add32313074f5a1e9b4ab379298dee8b6217e

Link:

https://www.unpac.me/results/25d7b1bd-64e2-48c2-bf3d-65232a4b1e1b/

SH256 hash:

26ee13ceb4c1b409a14de72d0cf8e1f3b0cb4d92a416b8618cff800df7762fb1

MD5 hash:

7154feb284bea623eaea7e5320d69567

SHA1 hash:

c27b7f385ccedc80dcaa6260328be47daaff37bd

Link:

https://www.unpac.me/results/25d7b1bd-64e2-48c2-bf3d-65232a4b1e1b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/26ee13ceb4c1b409a14de72d0cf8e1f3b0cb4d92a416b8618cff800df7762fb1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.