MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4
SHA3-384 hash: 0eed719ec4c9bd0b9c19a6aaa1273039ea4cc3d534d63970d58c2295b89375d0256e813bc83ceb0a4c71089b23ad2a79
SHA1 hash: db156f12eb1cb4d79087931d603cb4e12790035e
MD5 hash: 87117ff2b493b4eaea3e57f260508684
humanhash: glucose-jersey-fillet-nuts
File name:Maynew-order #Brazil-098484OBZ.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:602'112 bytes
First seen:2023-05-14 22:55:56 UTC
Last seen:2023-08-08 13:14:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:/M8whh2Y4YTk53/yxgvcFtSXB935jI9ituC9yQOQxK/dQQaI3Ve:08whh2Z3/yuU9XCwQ9K/dW
Threatray 2'885 similar samples on MalwareBazaar
TLSH T108D4E0A6D1B85F11CE641BFD1D63C4C60AF59AB57C24D8305E8B28CEDDA2E1F288817D
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Maynew-order #Brazil-098484OBZ.exe
Verdict:
Malicious activity
Analysis date:
2023-05-14 22:57:27 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/e4a9362d-8414-4d93-bbea-d7ac908aec2e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/389895/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67005573.17285.24931.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bc6a0d43-6554-4bf4-b9e4-f929755402b2
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1233069
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-05-12 08:42:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcmb3ynhvfqxosp6bjortohazafs3qeccggbzinzlzdv342oissa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
00b678e92dbc23f5d49fa664274e0896bc194d32957ce953340f078b7f740df5
Formbook
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
Formbook
2484f3b9e112f39471b0375d98ac190b4ffe3e29a295bcecdb8fd7b71af0094b
Formbook
2f63ebbdab728b4add526836bbe063788228b48240179035db13f85b9836559d
Formbook
6f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a
Formbook
a1fc12e0b11dc727c1e4f58da908d512b2ea1fb69cc317e024390440807d62eb
Formbook
abbf85558290e3fa302f88f51243e5216f24c9bc4fce64a0f616db3be2c46e8e
Formbook
b9bdf17b0783f5b073ba007091604c0407e825b17ae8ae90bf53d2a2140341ba
Formbook
d549aca33462425f1f32e75b6635986df724a63b6f738247d4be19de580bc899
Formbook
+ 2'875 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ca82 rat spyware stealer trojan
Link:
https://tria.ge/reports/230514-2wnhksdh29/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook payload
Formbook
Unpacked files
SH256 hash:
98e1311b8f852d84ca8015bf0397901a0f1a87dcdbbdce999e47ad09bea9f10f
MD5 hash:
04cf82b2c488a2f1b101288e84b12897
SHA1 hash:
6e579a9f44b591cc213f60d8ae7ac16760f02b3c
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/9dd4156e-e1e7-44b2-8075-80b2424a57a5/
Parent samples :
28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4
9bd6ff186abaaa8ad5ba8e89d2f12c87ea5fdac36e14af8192ad43655a90a972
9048c7507764dd285566e7bcdd0db1a5ca6554fc08739e9af182d4cc0a18e201
80a117ddcf71acfcb656a02ed92698d35fdd0150a31e7e4678bbb31bf30ab4b7
6ea7ca3a65d2621c8a9c7502eb9a7f914d5a155a3791e551cc3308f638ea307c
SH256 hash:
3ab1dcc37e7c5c643bf41e9f0f81f816f24974fbddde95e2af52426e3374dd35
MD5 hash:
8a2c496875c0871aecc16aae768b323f
SHA1 hash:
f5423a32125c70b512de301c5616c7b75477e2e7
Link:
https://www.unpac.me/results/9dd4156e-e1e7-44b2-8075-80b2424a57a5/
SH256 hash:
52bb75521380f34ec75b0e3dc894e01c74350e2df91e5fc3903b478f0e2baac2
MD5 hash:
e1f73499c42e58da472e9ad2550e80c1
SHA1 hash:
2a51be8edcad46688282910cbaee21355da1ae88
Link:
https://www.unpac.me/results/9dd4156e-e1e7-44b2-8075-80b2424a57a5/
SH256 hash:
d8fc5dfdf2800247eb610beb076fec4d2becf6d951e89445d43237fe97814218
MD5 hash:
e5d93dadd08b8bc727e4f4853c6881ba
SHA1 hash:
27e0e057d33f01586193b0cbf06561c2863951f4
Link:
https://www.unpac.me/results/9dd4156e-e1e7-44b2-8075-80b2424a57a5/
SH256 hash:
1b2409fb58a3293e9f1e4cbe7c9cdf7bee1a2a3c1b4c13c633bd49038e1d639b
MD5 hash:
b5df13cc7a872baef7df3fb09e221eaa
SHA1 hash:
070bc2c3380ed6522af97895cb4f98172cdac47c
Link:
https://www.unpac.me/results/9dd4156e-e1e7-44b2-8075-80b2424a57a5/
SH256 hash:
28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4
MD5 hash:
87117ff2b493b4eaea3e57f260508684
SHA1 hash:
db156f12eb1cb4d79087931d603cb4e12790035e
Link:
https://www.unpac.me/results/9dd4156e-e1e7-44b2-8075-80b2424a57a5/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/28981de1a7a9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4

(this sample)

  
Dropped by
formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/389895/

Comments