MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4427dbd6209079235487c24f4843a10d582fe6264fae0d107091e81133a8960c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4427dbd6209079235487c24f4843a10d582fe6264fae0d107091e81133a8960c
SHA3-384 hash: a6d8ac83c173adbfd6bdc03f88e91d0d954b9ff3f51fd31f4f461ad2a07b8d829edf8b9db94492f3a2907623dd5df75e
SHA1 hash: 4ce3b3d7688e14d4ca9451b77d223982b90cc80d
MD5 hash: b500c7c5801672dccc2dfae4b0e16c0c
humanhash: mars-wolfram-football-bluebird
File name:orden de compra.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'081'344 bytes
First seen:2021-05-20 17:46:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:FVzFy9p8WhXf/fFofLxEjr80832rbG1gfOg9d/F/9ra2V:rzcPFfnuT2jdc2HwGd/u
Threatray 35 similar samples on MalwareBazaar
TLSH 4535233126C8E7A9E83F7779B824B05903F85112EB21F71D7C9E516E0952B4B83F9623
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/160231/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.747-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4427dbd6209079235487c24f4843a10d582fe6264fae0d107091e81133a8960c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-20 17:47:16 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iqt5xvrasb4sgvehyjhuqq5bbvmc7zrgj6xa2edqshubcm5isyga._file
Verdict:
unknown
Similar samples:
0726eef18a27b6e019baa87d12d004efc1e0fb42169acedb5a56fee6d39d8946
Formbook
1cf2c4b90a84ce31c99a4b74ed546b17b2332a868f75293f237ea0bb0a5835c4
Formbook
1d3e01fb6e4f61f482bf3bc2628b5141a896284973eaa50c35bdb929a5aa541b
Formbook
290963ddb0862d90575e418931ac2cfacfbb79146f5846771e81046298bf75e8
Formbook
5501a072a478f1b6c6045154d4b3e5c102c5da98041f503d80b8a2b50bb6b85b
Formbook
5ef4f1d59492644372e4de91586798adb788432987848730694be8db0f968008
Formbook
69b433882a0be8350987589222a1b677cb948d1efea4e523b878a778bad33d4a
Formbook
b5d8a24e97905a0333243481930777008b654c43dd04bbf995d75334183c8070
Formbook
d4d22706033b31cb83ad489480e3ab88ad44e700560d42139995af8a1d45abc3
Formbook
f3bb0f029466577eb6ae2f65253d518335a8d4b7862454445d32a8339499614d
Formbook
+ 25 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210520-jxqysxwagx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 4427dbd6209079235487c24f4843a10d582fe6264fae0d107091e81133a8960c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/160231/

Comments