MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28375a1b1f2ea0e88846a60930ad76d4c68bd3f0545daebced5fb64fca085616. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28375a1b1f2ea0e88846a60930ad76d4c68bd3f0545daebced5fb64fca085616
SHA3-384 hash: f61fc432254c79e6584a3c0d8b3eb5e597b162156e751f158ee3ba6d439e31e8f84c9019ebbf2142f987a179846ac05a
SHA1 hash: b7205f180194d0feed170afa141db8dc3ab374ac
MD5 hash: 7fd322a7bb74f6c99645c84fc16cf062
humanhash: coffee-hot-lake-sixteen
File name:14 SEPT. 2023 D.G. SPARE REQT'N REF. NO. 41-23.doc.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:612'352 bytes
First seen:2023-09-15 12:30:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:kEj8FwLm/RzIBDqrW3rvvqeZctckJ4+Xn2qIiIcRSyb2wESkZM9/yXtQtuSBsJ:kEj8F6Iz4q67qdXi+Xn2uRSb5Sk3XtGC
Threatray 81 similar samples on MalwareBazaar
TLSH T16DD423C226C9DA3CE2DD03BD25B3064E1778C145D086C70CAFDA539D5E47B934BAA39A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter malwarelabnet
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
14 SEPT. 2023 D.G. SPARE REQT'N REF. NO. 41-23.doc.exe
Verdict:
Malicious activity
Analysis date:
2023-09-15 04:31:41 UTC
Tags:
formbook xloader stealer spyware
Link:
https://app.any.run/tasks/4cbe2a2e-477c-4355-b578-11b5b23c8e2b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.DownLoaderNET.710.3764.15430.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/65044e89829c3479a05efe58/reports/baf96fa7-1699-47c8-bcac-8df5e9bbbefe/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/28375a1b1f2ea0e88846a60930ad76d4c68bd3f0545daebced5fb64fca085616
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9758a45e-1339-4876-bc53-603105ea5f04
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1308930
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28375a1b1f2ea0e88846a60930ad76d4c68bd3f0545daebced5fb64fca085616/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-09-14 04:59:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fa3vugy7f2qorccguyetbllw2tdixu7qkro25phnl63e7sqikyla._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
05360352816fd2dfd09c05a57131f86c59fd38f7153c5261973216cf596ad077
Formbook
314b0463e6de6de56467f023dd2ddbf799d883e2e65552ddf2b87f607eedc5ae
Formbook
6372a7f93d8048d9105f81e38d773bffd87ab441e8354bc2100ca781d9b43037
Formbook
63b59f1390003e44ffbd4460d2b6811586b1aaaf155a64186397002160b370c6
Formbook
75a9fc79b2513a8964a0dcf3a0749a399a857d3feb2fa3c0d62de6f51ea5971f
Formbook
9fe145f64a6f2ed8283b9bfb1e97a3c93087d8495a53af984d619760c7d859a5
Formbook
9ffa96e46faf0575d49897cf2babb92f611980b60b539483d162cda6ddc19057
Formbook
a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048
Formbook
bdb41289aeeae3103dae4fa81bdaebb88311bcc6127b1c8c1a9afc96623adbbc
Formbook
efaaf9e72db8504655c4ae81958252dff7454667d9fd559d1f3a1a4b53a3c8ee
Formbook
+ 71 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230915-pp2qeaed76/
Behaviour
Gathers network information
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
5ec2db7731d55e932432b2ddfc4587d20a6abfb77699d24aa7dc5ab16b078bd4
MD5 hash:
e605e4995babfb835c676729e26e7256
SHA1 hash:
b2827dedacbf29aeabdb4d4ad30cabd87e646a9a
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
Parent samples :
28375a1b1f2ea0e88846a60930ad76d4c68bd3f0545daebced5fb64fca085616
95216d71fff102892599ac2c3e12742cc687eb8ab3eecb475366f69a38297511
29b23b45bbe02bff88d718bbc5fd3130d0da0801507fcf4697de838f12a3301e
SH256 hash:
23357120dac0baf5a0ca888a0d38ea889e1fd29bf4f458fd4e24eb832e0e68bf
MD5 hash:
0cef03560a4e4b4f0e758760caea4836
SHA1 hash:
b70d3fbf026e42e7e23ec24db2481ecce5c53bed
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
8f5c0c2eb2e763b06d10926f06ebbfc411e58bcabcb0a0a39257421e3ade308f
MD5 hash:
d04d4754040256cfad2c243631de5125
SHA1 hash:
5ebe5172272b91403ebf8ae5aa4c6a2d1630dc87
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
0cc2d545cdbc9aca7ac5732fc2e1858bae1b8c575e67f0b4b8077610c5597806
MD5 hash:
604ba9fe5293c6b09155e9593e5fe8b4
SHA1 hash:
c9ca531c5c50091dcdeabea6af26643e897fe3f8
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
fe2ec0d98502ec8c4f2294646702f0b708fdb41840081722fa4e732627884a02
MD5 hash:
1832e05359a278f9dcccc53bffee4244
SHA1 hash:
9583749008cce864ef1e5dfd3fa7d57edc823f8a
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
0630b864e828fff2d66f33ab7d00fad231df4c00fc0bbad313ee0d12ca503198
MD5 hash:
f559a9abbd849eb977d262d597d6e4fd
SHA1 hash:
0a8769b40b026852690c89b913c2812817ef43c8
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
Parent samples :
cef72412a1dd9486bae5f7e606d4330660fba98575ba1c939559ccc83536f41a
81ccf158093718305b3499d0f16d8a82bcad69f2740066daca8d5b5ca9979688
SH256 hash:
e34faacad0db5b807d080a88a196ba62a0758320901f872c88f15d5b4cd865b2
MD5 hash:
7bee6bf87bb1dd03ca64f63bed49afa9
SHA1 hash:
d982b87df4f62e86d9154f9c3ce3d68e0456e704
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
28a471998a60f71dc66c4e3d1bc78539d45ef336e36d7857554928666ae2c232
MD5 hash:
38b919d8739c8462cbd72f7a0b47c82c
SHA1 hash:
96a8d253bf0d4448177ef864afd79ce37ae83afa
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
d1f8d71ed23136826b03807876a8db277a2a61b531fe38e73d746496562481f0
MD5 hash:
7aa3138eda0d06f653b5e5cf4995cf5f
SHA1 hash:
925029fe0d6eb90c109e052b0cb0979bebf19fc1
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
950c504c7fdec6c9cd406287916953c22573d20ab00e46b4221020b2ae37e687
MD5 hash:
0b8af422953f9293c310702bcc6f059f
SHA1 hash:
63f92ddec28aa520950e9962a303b3ce4d1a0e24
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
755d6791edd90ef8d3c2444d6e0898b073c4df4d0b5d89bf458818035ea3cfa2
MD5 hash:
c90ce2f6ef5bad528c892193bdce87a6
SHA1 hash:
38867e9bdd0c830e4f23e5be71d2c2747905f672
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
7030ae46b90f3c83b37737b10086eefa2b7403dc2e11e00020961dc52d226c99
MD5 hash:
b6381dbb6164f16de822276c038bddb1
SHA1 hash:
29036f935ab83af281e914f5be5a5a08f75e4f10
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
SH256 hash:
28375a1b1f2ea0e88846a60930ad76d4c68bd3f0545daebced5fb64fca085616
MD5 hash:
7fd322a7bb74f6c99645c84fc16cf062
SHA1 hash:
b7205f180194d0feed170afa141db8dc3ab374ac
Link:
https://www.unpac.me/results/9414c6d8-e75d-44ec-aa1b-5194546a9268/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28375a1b1f2ea0e88846a60930ad76d4c68bd3f0545daebced5fb64fca085616

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments