MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173
SHA3-384 hash: fe8a8ce5ccc0b91e6d047a175710124a9beacb0cc0bf34a3ed1998d7b7822b5498071902c6c79a5eb3ebccb21beabc5e
SHA1 hash: ed686798d227845388dae9d62fad9d911dcca2e4
MD5 hash: 7bd655ad3d02f7e03a8cd4fdd30794e0
humanhash: summer-island-carolina-failed
File name:Fatura.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:619'008 bytes
First seen:2023-08-01 16:30:56 UTC
Last seen:2023-08-01 16:31:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:HX2iN8JJwReLOKYbyhjwLl9R4+1T9RKtpOmkMNA1IoyN9UVK8:HX1uJMeLhhmlg+bMtAmkTJybWK8
Threatray 3'473 similar samples on MalwareBazaar
TLSH T1C3D42274066597F5D93AA7B0B922D35543F6899A2321C987CEE63CDF3DB2F411020EA3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 7002f0f2a3aae829 (2 x SnakeKeylogger, 1 x AgentTesla, 1 x Formbook)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
282
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Fatura.exe
Verdict:
Malicious activity
Analysis date:
2023-08-01 16:34:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fbb34fa1-0853-463b-bd7c-a89123bf4d45

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/439649/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Creating a process with a hidden window
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64c93346907b8030b17d411f/reports/c39975e8-814f-4e8a-96dc-5a94bad65411/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2d6af774-e94f-4249-880b-39496af030b3
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1283880
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1283880 Sample: Fatura.exe Startdate: 01/08/2023 Architecture: WINDOWS Score: 96 41 Malicious sample detected (through community Yara rule) 2->41 43 Sigma detected: Scheduled temp file as task from temp location 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 2 other signatures 2->47 7 Fatura.exe 7 2->7         started        11 AewkAxqSoROaGx.exe 4 2->11         started        process3 file4 33 C:\Users\user\AppData\...\AewkAxqSoROaGx.exe, PE32 7->33 dropped 35 C:\...\AewkAxqSoROaGx.exe:Zone.Identifier, ASCII 7->35 dropped 37 C:\Users\user\AppData\Local\...\tmpD6E3.tmp, XML 7->37 dropped 39 C:\Users\user\AppData\...\Fatura.exe.log, ASCII 7->39 dropped 49 Uses schtasks.exe or at.exe to add and modify task schedules 7->49 51 Adds a directory exclusion to Windows Defender 7->51 53 Injects a PE file into a foreign processes 7->53 13 powershell.exe 21 7->13         started        15 powershell.exe 21 7->15         started        17 schtasks.exe 1 7->17         started        19 Fatura.exe 7->19         started        55 Multi AV Scanner detection for dropped file 11->55 57 Machine Learning detection for dropped file 11->57 21 schtasks.exe 1 11->21         started        23 AewkAxqSoROaGx.exe 11->23         started        signatures5 process6 process7 25 conhost.exe 13->25         started        27 conhost.exe 15->27         started        29 conhost.exe 17->29         started        31 conhost.exe 21->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-08-01 15:57:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
23 of 37 (62.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlkr5zy5ujugpecmk2filpjfpi7l4kx5wxi2jnwhorwbtmlugfzq._file
Verdict:
malicious
Similar samples:
09bf94af5ceabc708551e3bf599d3d94c8b3ced7606f2018c506cfc9b5a21710
Formbook
20fa6136a8a585a8f30110a5dd5fa9d8b2f9a2ee0eff590a721656eb44eceea0
Formbook
2beabdd285adf915fc07418c5f9e57cc4430f766b838e1726570c21af4868f18
Formbook
2c9e58b98c0929168074d7742170d85eb83c23f97aff8786381aec250af1d6f8
Formbook
7a08e064522b59f7198565d2437e6c1347837fc3bb0ddb2077e358d061160484
Formbook
97bd79e26600f552bfb5764aec1606acb63b830b5fefb807d12fe2088854a3cc
Formbook
c06a41f8cc26ea5c1258decc9ac07f2014b29266b4a3a7c0d7183dbc706ffeed
Formbook
c250549bfd9382d9489d8a0905c0b8bde28ec07f5af5d8b92e4ec8eb6cc72248
Formbook
+ 3'463 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230801-t1cymsae8t/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
8c2ca57a8a7420ea209eff1e6bfb7d96584493e0b23865b5438d473baae24239
MD5 hash:
ab622cf39eabb58381aecbda245d8233
SHA1 hash:
a154e6ca9e5ef486b4ea5d3794986316af5207e5
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/a4d59974-a5c8-46c2-a84e-321b65345143/
Parent samples :
20fa6136a8a585a8f30110a5dd5fa9d8b2f9a2ee0eff590a721656eb44eceea0
2beabdd285adf915fc07418c5f9e57cc4430f766b838e1726570c21af4868f18
c06a41f8cc26ea5c1258decc9ac07f2014b29266b4a3a7c0d7183dbc706ffeed
4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173
de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0
bd34a0f8b26f8e2715969b34a236ef365637ef80baff9d9781348e631b3406ec
SH256 hash:
b5084dddef652fcad599c2e52e71b8caf2420ecde2ce5c903848e21b0a531493
MD5 hash:
7e2f175c59b3ec03712cdf56c71ac58e
SHA1 hash:
45e8da5f9007525f31ff523761ae4502488a29ab
Link:
https://www.unpac.me/results/a4d59974-a5c8-46c2-a84e-321b65345143/
SH256 hash:
1dcc2630a57a85ed362bccb7a130b957b1713acdd145f7399b6dd8c62955e8e0
MD5 hash:
8763642a17fce45aa4812017fa49cefa
SHA1 hash:
bcc969039730812b9d7501247b92f06a8779cf4a
Link:
https://www.unpac.me/results/a4d59974-a5c8-46c2-a84e-321b65345143/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/a4d59974-a5c8-46c2-a84e-321b65345143/
SH256 hash:
4f57847b9cea60615f6f1c34dc839061446d91e124c3a729f817002a6c6d65d1
MD5 hash:
bbb5116e385be0d7d3073f58c2a3943c
SHA1 hash:
8a6fb94813ad09bf05ab355a2a2dc2828ac5ca71
Link:
https://www.unpac.me/results/a4d59974-a5c8-46c2-a84e-321b65345143/
SH256 hash:
4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173
MD5 hash:
7bd655ad3d02f7e03a8cd4fdd30794e0
SHA1 hash:
ed686798d227845388dae9d62fad9d911dcca2e4
Link:
https://www.unpac.me/results/a4d59974-a5c8-46c2-a84e-321b65345143/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4ad51ee71da2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/439649/

Comments