MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 502eb45094080794e04e0db85d0a1844f268407bd310d5a631fd185eab11b39e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 502eb45094080794e04e0db85d0a1844f268407bd310d5a631fd185eab11b39e
SHA3-384 hash: 6da6ee798e5f3fe6eeb10dc02dcd665886d3162c95c4cab3ea8ae5b150aba048c9778d126d53902470c623633d5ff9ae
SHA1 hash: ebd16281b6f67d893ad45c77b50f70292b142889
MD5 hash: f2738048e8f76a1e3f92a0b3ad75f08b
humanhash: muppet-bacon-bakerloo-butter
File name:f2738048e8f76a1e3f92a0b3ad75f08b.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:773'120 bytes
First seen:2022-11-25 17:54:59 UTC
Last seen:2022-11-25 19:47:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:D+M0DGjMEvMbzrbETCl2kFg/IyXCD8HV2Xr5Oci26BNnmb5bBO5xWjA7aaxbglKx:WmMEUb76CckFg/IyXtVwCJLmb5bsCjUf
Threatray 20'728 similar samples on MalwareBazaar
TLSH T16CF4CF296277BE32C27CDD71C1C165187FF28F055632FA06EEB732850E423662E97A49
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
430
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f2738048e8f76a1e3f92a0b3ad75f08b.exe
Verdict:
Malicious activity
Analysis date:
2022-11-25 17:58:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b2c8471c-bc61-451d-b685-5063e0e9d453

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/338539/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.1301.7107.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6381017a090ea3f0493493b8/reports/b4184168-38ab-4a9b-b423-d7d0d94c51e9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a8b0ec6e-9065-4dfa-bb03-4d35fe9db7ce
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1121288
Signature
.NET source code contains method to dynamically call methods (often used by packers)
C2 URLs / IPs found in malware configuration
Deletes itself after installation
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/502eb45094080794e04e0db85d0a1844f268407bd310d5a631fd185eab11b39e/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-11-25 06:15:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
22 of 41 (53.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kaxliueubadzjycobw4f2cqyitzgqqd32minljrr7umf5kyrwopa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0ef758cdcdaa95ecd6689cf13a719dd95def885bd1c5812295c2ed65d34b735d
Formbook
12748aea84778652c1b2fef43117bdb42de3061f4a4376927ca27154cce42013
Formbook
1c6bd398f9ee650ad9fd68a74846a169b61fbef689ee6abf8fb68962ccea4041
Formbook
22a8a048d90bb54c4bd72b1e91ca54eab47fa6eebf0b5e7cf903e9a822ccb25e
Formbook
33731252feaeeb328bcd5a7ab4ac6e08f2712313830fd612c8840d8e1424665a
Formbook
aabd50ed2fa819acc63c5209c80e7f18571057e452fae36f2b8fea580622ec9b
Formbook
d4c48b5aefc7225b307e2e8c3f2d158b14fc6b736c83d36dc36a9d7c2e6eec29
Formbook
e4b98a029783ce068a262f3393caa28754470082b6b7066f34a27595e5ff2ea2
Formbook
e898c914a7dd382b238cafeceedd4da12dc0c12d32630324c811e55b853eb88f
Formbook
+ 20'718 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:w086 rat spyware stealer trojan
Link:
https://tria.ge/reports/221125-whfb6adc87/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/985b7bb8-b4f8-41d6-aa66-9165f9af4dc3
Unpacked files
SH256 hash:
d46c34f0a0c5bf4316730eba075ac8cc8b78fa9843e86641e53c260caecbb959
MD5 hash:
05f74a08c86c90a8b96039ef8f63ccbb
SHA1 hash:
f7b111ee1c9a3df7a894b1ec6d450aea9b0695fe
Detections:
XLoader
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/f94dfc96-f4f1-4d9b-96ca-ee7e957006da/
Parent samples :
502eb45094080794e04e0db85d0a1844f268407bd310d5a631fd185eab11b39e
893f2dfd5758eb6fd8a7c8d9a6e83bc28ef165be2ef52c9a3ef4124f25dcd661
268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63
dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab
91fc06743f28fe6510f6e23c02532b67519f6bdc4ab6f93c0aa14abb8225d60e
98bf2d56d6648be19d20e78cc7f006b4ef48c5627c2e9ce70539b5a51fc9e5ad
SH256 hash:
2338186284297f25351ddc123d8046efc9b7d4cbac65172319fa72e2351005c7
MD5 hash:
09e865319428d4a49f353bde5fad3ab5
SHA1 hash:
dd5e7bf688d69a0d5995985a5690639029f0d52e
Link:
https://www.unpac.me/results/f94dfc96-f4f1-4d9b-96ca-ee7e957006da/
SH256 hash:
a327516357b9fa1a75753b3fbd0030e13f374be7cefcdf983d0b731f278b0c59
MD5 hash:
404efdeb9931733904da07f96fabeb72
SHA1 hash:
7ce363cd612f1d9a90b33ec196c4d0a49cdaee02
Link:
https://www.unpac.me/results/f94dfc96-f4f1-4d9b-96ca-ee7e957006da/
SH256 hash:
1135537405bdb972bf622ddbb33fb1721f8e128f1c2582d3fa1320d28aa37a67
MD5 hash:
0f98495c02b31d72c064b528f28aa0d3
SHA1 hash:
18264b25b5c9c0ae2285230e5c310f7422813baa
Link:
https://www.unpac.me/results/f94dfc96-f4f1-4d9b-96ca-ee7e957006da/
SH256 hash:
502eb45094080794e04e0db85d0a1844f268407bd310d5a631fd185eab11b39e
MD5 hash:
f2738048e8f76a1e3f92a0b3ad75f08b
SHA1 hash:
ebd16281b6f67d893ad45c77b50f70292b142889
Link:
https://www.unpac.me/results/f94dfc96-f4f1-4d9b-96ca-ee7e957006da/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/502eb45094080794e04e0db85d0a1844f268407bd310d5a631fd185eab11b39e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 502eb45094080794e04e0db85d0a1844f268407bd310d5a631fd185eab11b39e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2259317/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/338539/

Comments