MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fe516e9dac323f21ac793310c22d151e6d95079a59cc99ed6cad79691901c26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments

SHA256 hash:	2fe516e9dac323f21ac793310c22d151e6d95079a59cc99ed6cad79691901c26
SHA3-384 hash:	d71949cd65ff89cbc1918faf679d6262c827169273636f992ce908afe92a97ed54cd164e0aca08ea0dbdb766f4e6ce4f
SHA1 hash:	b52e820493af5eff89ef493321c110445791c9a7
MD5 hash:	b302c6cfe878c3ccb307a0f1f0b0241f
humanhash:	yellow-speaker-leopard-iowa
File name:	shipping doc.tnt.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	263'592 bytes
First seen:	2023-07-04 07:35:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:/Ya6DDg4+HDNnd2xF9rqCuUMOtxLMdX92+VRHDxWRt56eq:/YJD3+FMxS8MOtxLsX9DWn51q
Threatray	3'275 similar samples on MalwareBazaar
TLSH	T111441234BBF8C467D1A713B11E3F461B6AE9AE1114648A1613909F9E7EF3311D70EB82
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	abuse_ch
Tags:	exe FormBook TNT

Intelligence

File Origin

# of uploads :

# of downloads :

288

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

shipping doc.tnt.exe

Verdict:

Suspicious activity

Analysis date:

2023-07-04 07:38:09 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9c7938c5-c09c-4d0e-846b-5e3ea3661057

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/406301/

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.13480.23546.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Restart of the analyzed sample

Сreating synchronization primitives

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/95482/overview

Behaviour

MalwareBazaar

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/64a3cbe626dab9d9c850910d/reports/5e0458da-fba4-4b84-8dbf-4b1db43cb2d9/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/2fe516e9dac323f21ac793310c22d151e6d95079a59cc99ed6cad79691901c26

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/147c4ee3-dc53-49cf-b1b0-bd7a1b4bd0d1

Result

Threat name:

NSISDropper, FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1266434

Signature

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected FormBook

Yara detected NSISDropper

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2fe516e9dac323f21ac793310c22d151e6d95079a59cc99ed6cad79691901c26/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-03 12:06:03 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f7srn2o2ymr7egwhsmyqyiwrkhtnsudzuwomthwwzllznemqdqta._file

Verdict:

malicious

Label(s):

formbook

Formbook

2106aa8235bc1e05d367bae1e65c50bf8d11c4b4106ceebde0f9307ffcf273c0

Formbook

323f73b7cd367686fdc28a770469e6f6b3b1e45b6f375ef836bd3636880a102c

Formbook

47d1e16275d98873c63ed2cfe032b171513ff063ccc19399815846d950ed09d6

Formbook

7806b747871480b540e81ab255b9f18a97d7fd8ee150b2c85484acf08174b5ca

Formbook

8bdd2be4252011abdf68e5db8180c2e89988209789a204ed01c5d9c9a84aa66a

Formbook

b0302231ae277b08e383cef527b093307edf552a1777b5c9a088e2e1c61ad6fe

Formbook

c81c83ab1925106c70d6393edc0fcc117a4cb12ac96383ad28ceabe54c12fb4f

Formbook

ebce15ad53b98d7aba7f7544ee947e88f58d696e22ca4bc5d15b2ded37b577ac

Formbook

+ 3'265 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230704-je84vabe66/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Unpacked files

SH256 hash:

e19264c74d7e9e7bdb1285d3ee5e917860eeeb9fe8687b32db67706eaa31281a

MD5 hash:

542ef80ceb62960eb33fbe6032e7d61c

SHA1 hash:

6e68147757bfb122d5915751ec99e454ee46923d

Detections:

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

Parent samples :

2fe516e9dac323f21ac793310c22d151e6d95079a59cc99ed6cad79691901c26
f2674b3bee2f8ae1a08576a04c6d301e58f33a5c6456d32e09bde8e7997479a1
4ff429625da9915e133c7c495e85cd4235813784fbc251d7259db33c77b81f29
bfb1e4ae02e8f53a6d2023eeda4399be5502b9ab99770c9c3e4bfde0548a459b
490129df3b9f148b27f875a33d9e4d584a3470250d46b5ef5bfee336644081b0
831fb5c161081d10c2e952ef793f5db28c5aba8b7e0e858aa1e755481b875baf

SH256 hash:

11b0695e4b2ff83ae2454447092e1ca84581d3341dba1433fba718f13851e575

MD5 hash:

18462fcdfc6d9057e79fed9ef4d57d79

SHA1 hash:

427f69305ee749e27fd865cb220a2a79d5c037a0

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

SH256 hash:

e19264c74d7e9e7bdb1285d3ee5e917860eeeb9fe8687b32db67706eaa31281a

MD5 hash:

542ef80ceb62960eb33fbe6032e7d61c

SHA1 hash:

6e68147757bfb122d5915751ec99e454ee46923d

Detections:

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

Parent samples :

SH256 hash:

8cf6e16c12e869ab7039933397aa020e3cc7f1107a899b6271175ff8a6194384

MD5 hash:

b20efe07bd4fd09dbeb0cf918b7e19e3

SHA1 hash:

6ecd48ca304ede25ba20065e85b74e17c77490ea

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

SH256 hash:

e19264c74d7e9e7bdb1285d3ee5e917860eeeb9fe8687b32db67706eaa31281a

MD5 hash:

542ef80ceb62960eb33fbe6032e7d61c

SHA1 hash:

6e68147757bfb122d5915751ec99e454ee46923d

Detections:

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

Parent samples :

SH256 hash:

11b0695e4b2ff83ae2454447092e1ca84581d3341dba1433fba718f13851e575

MD5 hash:

18462fcdfc6d9057e79fed9ef4d57d79

SHA1 hash:

427f69305ee749e27fd865cb220a2a79d5c037a0

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

SH256 hash:

11b0695e4b2ff83ae2454447092e1ca84581d3341dba1433fba718f13851e575

MD5 hash:

18462fcdfc6d9057e79fed9ef4d57d79

SHA1 hash:

427f69305ee749e27fd865cb220a2a79d5c037a0

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

SH256 hash:

8cf6e16c12e869ab7039933397aa020e3cc7f1107a899b6271175ff8a6194384

MD5 hash:

b20efe07bd4fd09dbeb0cf918b7e19e3

SHA1 hash:

6ecd48ca304ede25ba20065e85b74e17c77490ea

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

SH256 hash:

8cf6e16c12e869ab7039933397aa020e3cc7f1107a899b6271175ff8a6194384

MD5 hash:

b20efe07bd4fd09dbeb0cf918b7e19e3

SHA1 hash:

6ecd48ca304ede25ba20065e85b74e17c77490ea

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

SH256 hash:

2fe516e9dac323f21ac793310c22d151e6d95079a59cc99ed6cad79691901c26

MD5 hash:

b302c6cfe878c3ccb307a0f1f0b0241f

SHA1 hash:

b52e820493af5eff89ef493321c110445791c9a7

Link:

https://www.unpac.me/results/ba10442f-2779-4cb6-9a03-2bb89c54837e/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2fe516e9dac3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Windows_Trojan_Formbook Create hunting rule
Author:	@malgamy12

Rule name:	Windows_Trojan_Formbook_1112e116 Create hunting rule
Author:	Elastic Security

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.formbook.

Rule name:	win_formbook_w0 Create hunting rule
Author:	@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/406301/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample