MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e7a2d297395633bb98f5a8e2c51ed41bad9e7b8917eca00aa9b83517d16eb91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments 1

SHA256 hash:	4e7a2d297395633bb98f5a8e2c51ed41bad9e7b8917eca00aa9b83517d16eb91
SHA3-384 hash:	b883d71aa2fd488690cce039267e887b611c4d3f3797bd353231b140e4246505754c1ec5a9891fc61ab78703da4a7e13
SHA1 hash:	8d8d8261358f19dd12e6988a5a543ba0b62e204f
MD5 hash:	de4419c0142a84761ed9abddcbc8bd76
humanhash:	missouri-diet-bluebird-west
File name:	de4419c0142a84761ed9abddcbc8bd76
Download:	download sample
Signature	Formbook Create hunting rule
File size:	359'424 bytes
First seen:	2021-10-10 02:47:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'655 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	6144:/4/m0gEcqdGdOC3GZt2tQJfru5VckxBWL0VbhHhTPboNK5StFfQxbSYw:/dGcqdmOXZt2tQQ5fB9hsHa
TLSH	T1DD74120C6C5713ECD2282CB2B8AD7A6B3EC9616D4AB5D14F64120BD41DD43A00BFAD7B
File icon (PE):
dhash icon	c0a2a2a2a282e860 (1 x Formbook)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

220

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

de4419c0142a84761ed9abddcbc8bd76

Verdict:

Malicious activity

Analysis date:

2021-10-10 02:49:24 UTC

Tags:

loader evasion stealer

Link:

https://app.any.run/tasks/daa94915-af29-445c-adb7-a4701a1b2fc7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/196352/

Detection(s):

Win.Packed.Bulz-9769773-0

PUA.Win.Packed.ConfuserEx-6582917-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a process

Creating a file in the %temp% directory

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

black confuserex obfuscated packed

Link:

https://www.filescan.io/uploads/616254651c2d58ba74fe71bc/reports/a97f7800-859a-48be-bdcf-267d719aa582/overview

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e7a2d297395633bb98f5a8e2c51ed41bad9e7b8917eca00aa9b83517d16eb91/

Threat name:

ByteCode-MSIL.Trojan.Perseus

Status:

Malicious

First seen:

2021-10-08 08:02:00 UTC

AV detection:

22 of 27 (81.48%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jz5c2kltsvrtxomplkhcyupnig5ntz5ysf7muafktobvc7iw5oiq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

collection spyware stealer vmprotect

Link:

https://tria.ge/reports/211010-dafnvafee4/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Looks up geolocation information via web service

Deletes itself

Reads user/profile data of web browsers

Downloads MZ/PE file

VMProtect packed file

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/4e7a2d297395/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4e7a2d297395633bb98f5a8e2c51ed41bad9e7b8917eca00aa9b83517d16eb91

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HKTL_NET_GUID_StormKitty Create hunting rule
Author:	Arnim Rupp
Description:	Detects c# red/black-team tools via typelibguid
Reference:	https://github.com/LimerBoy/StormKitty

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_NET_NAME_ConfuserEx Create hunting rule
Author:	Arnim Rupp
Description:	Detects ConfuserEx packed file
Reference:	https://github.com/yck1509/ConfuserEx