MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e656c26bcb61fd298e40b8c1f737a98bf61306321cbaaedd860175cef54b817. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e656c26bcb61fd298e40b8c1f737a98bf61306321cbaaedd860175cef54b817
SHA3-384 hash: a45d0bf4b939add74c11310e6b7a6beb04b2b798c3b440e9f2d8f3bffb01f6381209cee50eb39aa97fc6ea10526bcb82
SHA1 hash: 7bb4aae1c89a47edf441daa545051a34fc2a85ca
MD5 hash: 8a74d68183d93cd37e618f68097db773
humanhash: summer-lake-cardinal-uniform
File name:d9KRjZOKQKODZB4.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:911'360 bytes
First seen:2024-06-03 06:32:56 UTC
Last seen:2024-06-03 07:29:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:i7by52GN5i44Ca7YBFjEUfM1JFV07jFqQNrWCFM:i7by52GN5i44r7YBFjZkVug2WC
Threatray 245 similar samples on MalwareBazaar
TLSH T1AC15CFB933282F8FD93E03F4919884C05BF54560358AEFC9CDE1A4EA96D5FD1878246B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon cca6032939292d92 (16 x AgentTesla, 8 x Formbook, 2 x Loki)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
366
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3e656c26bcb61fd298e40b8c1f737a98bf61306321cbaaedd860175cef54b817.exe
Verdict:
Malicious activity
Analysis date:
2024-06-03 06:55:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/20e50f2a-7f66-40a5-9a6c-2a2be228a68a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.12420.14971.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=665d74393967e80cbb31aa2ewin7simulatehigh_evasion
Tags:
Banker Encryption Execution Network Heur Dexter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed vbnet
Link:
https://www.filescan.io/uploads/665d63ac0bf5978c0b0b9f4b/reports/3712316f-5f63-49c2-8a22-74f872688df4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3e656c26bcb61fd298e40b8c1f737a98bf61306321cbaaedd860175cef54b817
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/247a239d-46df-4c62-88ce-f965419a328b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1450805
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1450805 Sample: d9KRjZOKQKODZB4.exe Startdate: 03/06/2024 Architecture: WINDOWS Score: 100 55 www.yow79.top 2->55 57 www.wwwjs711.com 2->57 59 21 other IPs or domains 2->59 71 Malicious sample detected (through community Yara rule) 2->71 73 Antivirus / Scanner detection for submitted sample 2->73 75 Sigma detected: Scheduled temp file as task from temp location 2->75 77 8 other signatures 2->77 10 d9KRjZOKQKODZB4.exe 6 2->10         started        14 XhsooieCqHq.exe 4 2->14         started        signatures3 process4 file5 51 C:\Users\user\AppData\...\XhsooieCqHq.exe, PE32 10->51 dropped 53 C:\Users\user\AppData\Local\...\tmp8153.tmp, XML 10->53 dropped 87 Uses schtasks.exe or at.exe to add and modify task schedules 10->87 89 Adds a directory exclusion to Windows Defender 10->89 91 Injects a PE file into a foreign processes 10->91 16 d9KRjZOKQKODZB4.exe 10->16         started        19 powershell.exe 23 10->19         started        21 powershell.exe 23 10->21         started        23 schtasks.exe 1 10->23         started        93 Antivirus detection for dropped file 14->93 95 Multi AV Scanner detection for dropped file 14->95 97 Machine Learning detection for dropped file 14->97 25 schtasks.exe 1 14->25         started        27 XhsooieCqHq.exe 14->27         started        signatures6 process7 signatures8 67 Maps a DLL or memory area into another process 16->67 29 NRNTmdcxYGdjiIrx.exe 16->29 injected 69 Loading BitLocker PowerShell Module 19->69 32 WmiPrvSE.exe 19->32         started        34 conhost.exe 19->34         started        36 conhost.exe 21->36         started        38 conhost.exe 23->38         started        40 conhost.exe 25->40         started        process9 signatures10 99 Found direct / indirect Syscall (likely to bypass EDR) 29->99 42 expand.exe 29->42         started        process11 signatures12 79 Tries to steal Mail credentials (via file / registry access) 42->79 81 Tries to harvest and steal browser information (history, passwords, etc) 42->81 83 Modifies the context of a thread in another process (thread injection) 42->83 85 2 other signatures 42->85 45 NRNTmdcxYGdjiIrx.exe 42->45 injected 49 firefox.exe 42->49         started        process13 dnsIp14 61 www.hexwax.top 203.161.55.124, 49738, 49739, 49740 VNPT-AS-VNVNPTCorpVN Malaysia 45->61 63 amazune.com 131.153.165.35, 49729, 49730, 49731 SS-ASHUS United States 45->63 65 10 other IPs or domains 45->65 101 Found direct / indirect Syscall (likely to bypass EDR) 45->101 signatures15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3e656c26bcb61fd298e40b8c1f737a98bf61306321cbaaedd860175cef54b817
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e656c26bcb61fd298e40b8c1f737a98bf61306321cbaaedd860175cef54b817/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2024-06-03 06:33:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzswyjv4wyp5fghebogb6432tc7wcmddehf2v3oymalvz32uxalq._file
Verdict:
malicious
Similar samples:
0220e969f9fd1e5cadd143f94dc7fdfe26971096227ff4005a8bf96bb316c4c2
Formbook
2fd124c946b4f17ea425efc750a9523c8e06c17b6e23671f706fe889bd2492e0
Formbook
b701bf37269733703c98781507453ff72ee36b7882d35ffc6717e1eb67b4212b
Formbook
f2e1790a36ac95e802bdac123aede4a277b2a7da39ea9b6e399f9545dac51a50
Formbook
fe566ca240ef3e71e3e89148972262960bdf11281cba8354f262d834cb9b59f4
Formbook
+ 235 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/240603-ha8f3sga53/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/570c0635-cb48-4473-adab-59b8378f109d
Unpacked files
SH256 hash:
091250d76a8aeacfa27cfc7dd605a455d22706ef5c189d8903879d0592eb1079
MD5 hash:
f12bfae3ec26373eb0fd09e0edc2df52
SHA1 hash:
3408983b554edc4a7014cc78628cbbc94a7fe56d
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
Parent samples :
3e656c26bcb61fd298e40b8c1f737a98bf61306321cbaaedd860175cef54b817
0c7a66057004515fbac9276dcdbfb9594afd4316ebe900a9ead8d40f6008078a
SH256 hash:
634ef168b3d07f99a92444457a98f695025920119ef3f9afb16896346c311ac3
MD5 hash:
9b7b31d7f03ab0f2de7df90e83f758a6
SHA1 hash:
97e3b121df9fb0b408d280d63258fedafb7605c3
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
def130f4ca749a64f4ea327e0ed1d31748e71eac6a3ea1e55d6d8af0265be9a2
MD5 hash:
52c77b113caaa2f214bd0f45d547a6eb
SHA1 hash:
efb3b9c4c558d82e50869d71595df1eae2810147
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
f0b31fdfeb5a48b4176e0271e32809f687fd64db9046bd7077b95daa170528bc
MD5 hash:
285ac9fbe20cd2af9dced5dd28a761f6
SHA1 hash:
eceb1b95d167a84d7af82868747dd5a13f0aee66
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
46928f1db48c24f20937b8152d5456d94ba5db23f427a16beb6b802ea9b2c52b
MD5 hash:
efe8c102c455a8624b84d768816ecbe2
SHA1 hash:
0042ba8eb79506fccef7b483f53a703524260e00
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
0822055f4853d09faca097dd01dfaf04d17f41257deaba25aeb27a9b95226287
MD5 hash:
21d94b8c6ee1dba06797f700afad0103
SHA1 hash:
e4ad872ddf1e820e0f432aed7f8ef74b0d205cbb
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
fa360ed0a48d211d05d2ffb2ed7e53a29ea4ad53f918f51db3f67eacb8619099
MD5 hash:
2621641926d2c7d97e6031b86b4e245b
SHA1 hash:
b3b259ee5f22ea2b10c156027f631f4a6478d9e7
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
b399468035ac72df803a71d294e0dd54f0b3c5dc8203af66806502073ed75e39
MD5 hash:
d12aa8b477c05de0a5c12bbe110bec7f
SHA1 hash:
9979ef5dfbb08781cae04f1effa5f4b5a7353a98
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
736f95e3c402fcb6689882606c1110e78f2c01a00ebae0cd10bfce52733e28c4
MD5 hash:
54d71e2a63aad54e58693d80afdc6e0d
SHA1 hash:
62a6cad738bf2b73cdb150aaf2150371a3300b59
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
daad744bb808b5b71e1c44c896518bd8a1e1d3e9f6576790244103cb6cb1a83d
MD5 hash:
8c3926c72fd63d4439bdac26c74d4148
SHA1 hash:
3de8d6df2d605e6f71bc23dfe29f29fd0a9f6aa3
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
434a58a9272f5daf85f88669299ca2c083ae88fe12374d343300396f07653a5d
MD5 hash:
de163ecdf6c67a4e3651e334461f8067
SHA1 hash:
17263c3f821349d017016cdd037e2c15b5829f54
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
SH256 hash:
3e656c26bcb61fd298e40b8c1f737a98bf61306321cbaaedd860175cef54b817
MD5 hash:
8a74d68183d93cd37e618f68097db773
SHA1 hash:
7bb4aae1c89a47edf441daa545051a34fc2a85ca
Link:
https://www.unpac.me/results/2a1b3cba-1f96-4df0-ae81-f7c2a27539f5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3e656c26bcb6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments