MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b
SHA3-384 hash: 4dad13505739a43c8d190d2a74314c0b5d84ba604ee9948362ef35f5b675de0246e192998e897f1606c8a90c0e1c7900
SHA1 hash: d0810fba6ed9a34f334d8fdd42a0d2501d346587
MD5 hash: 09a39bd1ee075d36c3e713e8e70ca01e
humanhash: angel-oklahoma-fix-cola
File name:09a39bd1ee075d36c3e713e8e70ca01e.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'004'544 bytes
First seen:2022-03-23 20:01:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 24576:R4qOEj+67Me533BEK9DUjmUNFhpTU+oR3Tz6qbu:iij+6wSnBEK9AmSTfo5TOq
Threatray 14'376 similar samples on MalwareBazaar
TLSH T1F32523C132E9BB25D23C0B79D0B56185177A559BBE22DE7EEE41429E0E333C0CE21697
File icon (PE):PE icon
dhash icon dadadadaa6a6a6a6 (12 x Formbook, 8 x AgentTesla, 5 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/256856/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f3936e9-e373-452d-bcd0-6e0c1e6eaffa
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/963212
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 13:53:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2c797f8b23257f74c2dd577dad2c2c6cdab90dfa57a57f2f89a8a54036c6852c
Formbook
3662913e3004f6e3811499a9877265b55fd4b99400607d2f4b4168dc2621f1ab
Formbook
3e3ccb3b130c86bb2d82a52f8a7e191efa9499577ba0a3d3f335d5a1e1597b76
Formbook
4cc5a0fb10d6235a197da2d08df9af6afae59ceaffb0c7054cfb087eb5c039b6
Formbook
5aad7a3f3d55c4741d8a79b59e0e9f922d375adab9f998ababc03a88a2feb27c
Formbook
6bd24ce0a16599d97686146c6a822023f0f4896fcee914eed9a4e45a7e46b864
Formbook
8ddc14ac94185fbe27b3764fb4e24fd8c25626a465074e8f640955a6f3409c08
Formbook
8e079aa4afe26627a784ac447071b5dcd460ba1393851199e21da312a6ff2f18
Formbook
bc91c7988916b582c31a55f44cbdebcfae416c3f645bf8826485fc358e0ac0e7
Formbook
+ 14'366 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:m0a8 rat spyware stealer trojan
Link:
https://tria.ge/reports/220323-yr6a2saeb6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Unpacked files
SH256 hash:
8eb8f44af58ae986986469b04f5c991c95ad5eda8c96dbbe938fcd7f7e87fdb3
MD5 hash:
89bc7cef19d898eae5f43966393fc1fb
SHA1 hash:
a31292d9f39f9fd58ff0102e3fb8e2692137d6ea
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/5200d5c5-9296-4e49-a225-43e1c4234153/
Parent samples :
3aff0b3e7195005380f87feb7753190fa70cd885d10721e2fac690eb41690f2b
6bd24ce0a16599d97686146c6a822023f0f4896fcee914eed9a4e45a7e46b864
5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b
de9fdb344c542595de3ddf65357a6982f0085d0f7b42c1de534c3963134c2cb3
eabfcd738bc46581870a5671823ed4dda66a507606187b0f2a25a3b0f1fa9720
SH256 hash:
9e36aac1b4bf308c675967d0f601ef0dcc4d70c4bb961a8235e18efed7b6132c
MD5 hash:
d2714a8c6280cfc9b883fd33505722a1
SHA1 hash:
d6e8b1567357ae3ce4a389873374a7b12c1dfacc
Link:
https://www.unpac.me/results/5200d5c5-9296-4e49-a225-43e1c4234153/
SH256 hash:
dc5c057b0ee1eb079cf189762aac69f0d86338ea18795dc4fbf7ed9b5a45c2eb
MD5 hash:
4103ed94f4747b30e166cf3c25416f47
SHA1 hash:
d553a67056e94f60d621ca42dcecd6d93f9ef1ad
Link:
https://www.unpac.me/results/5200d5c5-9296-4e49-a225-43e1c4234153/
SH256 hash:
6b7df74ace2da4d1d1d91ca0502c5d9f505563a174b30da71e94ca5af31a95b8
MD5 hash:
6084545495c4bdff5dc0ce384b606ae7
SHA1 hash:
cd4e6604e9289ec335046e53a2b00ab98c97fb9f
Link:
https://www.unpac.me/results/5200d5c5-9296-4e49-a225-43e1c4234153/
SH256 hash:
5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b
MD5 hash:
09a39bd1ee075d36c3e713e8e70ca01e
SHA1 hash:
d0810fba6ed9a34f334d8fdd42a0d2501d346587
Link:
https://www.unpac.me/results/5200d5c5-9296-4e49-a225-43e1c4234153/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2111106/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/256856/

Comments