MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 49fe1618c14d32183b774338d27a474d16e05519bb3967940fb33e6af06170f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 15
| SHA256 hash: | 49fe1618c14d32183b774338d27a474d16e05519bb3967940fb33e6af06170f0 |
|---|---|
| SHA3-384 hash: | 5bd7697b07d6f00f19314ddade0e8f73dfc1fc6dd700fb86c596d1d4eb9cc9ea307bd6cc79087414337a38bc3bb9ffdd |
| SHA1 hash: | 819b0e51990567c96d918566502c60c290628790 |
| MD5 hash: | f1d9d5c0b4a2f7974e9ec0440203b453 |
| humanhash: | carbon-muppet-snake-wolfram |
| File name: | Zahlungsbestatigung.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 955'392 bytes |
| First seen: | 2023-02-15 11:59:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:ApCip2wbB2gB2iNdtQbTBeiTGiK4hl3YM+is3DQ8XFktwIbFA:ApCiHV2K1ntQb9V6Yta4twc |
| TLSH | T19415491033E96764FAF76BF10872808187BA7E6AB93DD26D1D8511CD1D32F618B11BA3 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
207
Origin country :
DEVendor Threat Intelligence
Malware family:
formbook
ID:
1
File name:
Zahlungsbestatigung.exe
Verdict:
Malicious activity
Analysis date:
2023-02-15 12:00:32 UTC
Tags:
trojan formbook stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
67%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Status:
Malicious
First seen:
2023-02-15 12:00:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
40
AV detection:
19 of 25 (76.00%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
e9d646bb05e91c1e8695d76931f396086c3b0ac3a555c9e0254fa1a050150159
MD5 hash:
daa5dc958c921ea4a72c9102a0a58ba1
SHA1 hash:
75a39eb8017bd1bd424ce137d1f80688c58afbd7
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
e6aaa47556e208d4fe343c936074e6e7b7c7353dc484e73ecb07662965fb218b
MD5 hash:
3488a0fb8d115d43c3c4667230784503
SHA1 hash:
63b1508d1415bd31a3c15ce69aacf95a1f8102a1
SH256 hash:
e4fb293bf21e39ea9b3623c51c831698ad5df40a8546b0b35d2524cdb83423d3
MD5 hash:
fa229ed167db15565caa30d4ec3f9b70
SHA1 hash:
bc10c743315029ee0ac83472fbe1f29c2291b2a8
SH256 hash:
3c19b794e9ddca7e48159a4c12664c9a7f52d872a7de26140747f851ddd1fc04
MD5 hash:
fe3ec09db67c34f0e8912decef3350cb
SHA1 hash:
9334ca9a320b1df9f68f55ce2eae7463cff24437
SH256 hash:
c12d2628d984c0b8071e1daa76812d8eae5cd9a18dd99eac444ba00d38977501
MD5 hash:
ec47f2cc8cb2264f192660aa1c81f96d
SHA1 hash:
50b322aa2022e5570911ceb2ca39aeaeca91e540
SH256 hash:
8f0c7e3047346b8d6477ff6d4639fd6157602c7ebc840f3432b99263f1cb415c
MD5 hash:
e5b073b30db1b058298f5df032164e4d
SHA1 hash:
15d3ada4e7ac01b766615b9b66785e7e2ae9b0ca
SH256 hash:
49fe1618c14d32183b774338d27a474d16e05519bb3967940fb33e6af06170f0
MD5 hash:
f1d9d5c0b4a2f7974e9ec0440203b453
SHA1 hash:
819b0e51990567c96d918566502c60c290628790
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.