MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f409d66b5e4403f5c05ff19c88acd96d0ee3a0511c4ebca73abe01ced6eb5b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f409d66b5e4403f5c05ff19c88acd96d0ee3a0511c4ebca73abe01ced6eb5b6
SHA3-384 hash: 5fc8d66bf7f580a8b42d9ee36b9512265612015cf6253529691e8d54ffd044d205090bb34457d881322440c26869c79b
SHA1 hash: d48186b338445f25fc92c9aede867010be3c3b8f
MD5 hash: 7391f0c0a4cd63ecedef46dbb072542c
humanhash: skylark-oranges-william-one
File name:PO CCTEB77.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'154'048 bytes
First seen:2023-12-02 16:38:48 UTC
Last seen:2023-12-02 18:27:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:dMoF0IXV7bsXRvuARtoW7Q4JnGYfpBhtD/:y+7bGRvNRto+GY3
Threatray 445 similar samples on MalwareBazaar
TLSH T100358ED1F1948DDAE86F06F1BD2AA53011E37E9C54A4C10C5A99BB5B26F3342209FE1F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
288
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/461911/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Restart of the analyzed sample
Creating a file
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
91%
Tags:
packed
Link:
https://www.filescan.io/uploads/656b62911dea9b05c3d066e6/reports/38e92def-9693-4535-a16c-1f58016a6279/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5f409d66b5e4403f5c05ff19c88acd96d0ee3a0511c4ebca73abe01ced6eb5b6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f9fdec4c-e1b5-4357-bb79-329b2be8fd5f
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1352162
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5f409d66b5e4403f5c05ff19c88acd96d0ee3a0511c4ebca73abe01ced6eb5b6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f409d66b5e4403f5c05ff19c88acd96d0ee3a0511c4ebca73abe01ced6eb5b6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-11-27 07:27:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
34
AV detection:
26 of 37 (70.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l5aj2zvv4rad6xaf74m4rcwns3io4oqfchcoxsttvpqbz3loww3a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
11d9bfab2d9c7344ef52970bd53f3dae040d3821f8ff0a03ba1f3d92593f7717
Formbook
19c50b3c8e3c4e074f378c9df1f484ca4f79c49fb2310880dad80eb09433f2fd
Formbook
259e6fc89c741d8f3a240402ffb767e833317bea4e190ba44e516adf63cd5b82
Formbook
38fec907dc95bfe40e4eb9d109587dec7169e274c3a5515a19f2975b6dca3c96
Formbook
4d5e7328c921bb038230d1e5bf189caf0e872b5c78c6a98b05526a3d876e8623
Formbook
ab7f85f4adde2c79c6c465b22e43f09a8bbba24b47b477ef00c2729ebd6bf268
Formbook
bf7c1a1fdf3903e051dcc7136e63e73ddc16e07c00d87553db63f4b7eadcb14e
Formbook
ddafb7c555ea7194a651ee7fbdc40ef9db4253b9e2e318a16b0a72223eb8b42d
Formbook
e37b7ab55a181fa8e716b4694e85736075ce0d67b7b3aa024d7fcc7f65f1e0fb
Formbook
f9b14ff098a68f6150bd3e40ded6710ce1a0a11962e5b198beb1bd3a7863a2b1
Formbook
+ 435 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/231202-t5y2nsea3t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c7cf6ecfb9c2b4325a439cface9453086d5ed900b05e2bc210654c34ce0ee719
MD5 hash:
3370bb8a3bfaadd045f8034d8ed2d2fe
SHA1 hash:
635d76f697928368fed73b37962f6fd93a376fbf
Link:
https://www.unpac.me/results/ab1637e7-b376-4bb5-907f-fc54be3165ab/
SH256 hash:
0982ab0a8c1ac6077ea03aae7f912be1ace5f320c163e371275ba299bdbc9263
MD5 hash:
aa7ca1aab84badaaaede42eaab55edf5
SHA1 hash:
201711bd71a46ff9b00a7e04b5afabdc70af2425
Link:
https://www.unpac.me/results/ab1637e7-b376-4bb5-907f-fc54be3165ab/
SH256 hash:
9b4782435f360ecc5faeb31e402c8ec44057a57b28073419aa8379a3c33c2c93
MD5 hash:
ccd0bcc6cc01923e5ddf4ba72fc8fa12
SHA1 hash:
f2d4bd262aa5a6e2cf439488c1cae3968ab8d34a
Link:
https://www.unpac.me/results/ab1637e7-b376-4bb5-907f-fc54be3165ab/
SH256 hash:
f5a8f5ded618fd3989fa98a3c2d87c4853d6e10ecb1313cd5ddd7df375336b31
MD5 hash:
243f9990bb7d68a3f6e4d3999800da5b
SHA1 hash:
ba555175d12f19f6288a3574738bcd6c8b747e3b
Link:
https://www.unpac.me/results/ab1637e7-b376-4bb5-907f-fc54be3165ab/
SH256 hash:
521e80f9f6d4c83ed955b3d962ad03e3da7d47a1c7ec97b8b8ef56fa666e9613
MD5 hash:
dcae7a66848fb55e5bd5a6b16598703d
SHA1 hash:
5649d8815fa78e67101e52a4e19115ed0826dfbb
Link:
https://www.unpac.me/results/ab1637e7-b376-4bb5-907f-fc54be3165ab/
SH256 hash:
5f409d66b5e4403f5c05ff19c88acd96d0ee3a0511c4ebca73abe01ced6eb5b6
MD5 hash:
7391f0c0a4cd63ecedef46dbb072542c
SHA1 hash:
d48186b338445f25fc92c9aede867010be3c3b8f
Link:
https://www.unpac.me/results/ab1637e7-b376-4bb5-907f-fc54be3165ab/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5f409d66b5e4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f409d66b5e4403f5c05ff19c88acd96d0ee3a0511c4ebca73abe01ced6eb5b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 5f409d66b5e4403f5c05ff19c88acd96d0ee3a0511c4ebca73abe01ced6eb5b6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/461911/

Comments