MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210
SHA3-384 hash: a715330f1616303157ba6997e0f7d547094d016c8745049f0997c36e4ea339bdb6abbb3dd2077a189ada2dfcfc1b0818
SHA1 hash: aa95561963a9e0ef26a09f4f908f3e0f8f2153b8
MD5 hash: cdacf3f5255f21aef3d4ef7812bd23a1
humanhash: enemy-carolina-twenty-hamper
File name:PO_# 315418.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:613'888 bytes
First seen:2023-09-29 09:13:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:4725McFZIYVAbsJAalkw1DOLv4r9WzF3h/SDxl/nOX+6CSVZPUFkH:TFZIy4UtpYU9idGmX+kPU
Threatray 50 similar samples on MalwareBazaar
TLSH T1ADD42258B8EA8B35D94E4339ABED514943F0B171A802F36DC9EA60CF4F397086661F47
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon b26969e8e8e8f0f0 (23 x AgentTesla, 13 x Formbook, 3 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
287
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6516955a33582f234e06be5f/reports/e5f7a922-0c71-498a-a592-58be8975c0d3/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/71399b08-cb3e-42d7-990b-e087b09e3bb8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1316327
Signature
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1316327 Sample: PO_#_315418.exe Startdate: 29/09/2023 Architecture: WINDOWS Score: 88 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected FormBook 2->32 34 3 other signatures 2->34 9 PO_#_315418.exe 3 2->9         started        process3 signatures4 38 Injects a PE file into a foreign processes 9->38 12 PO_#_315418.exe 9->12         started        15 PO_#_315418.exe 9->15         started        process5 signatures6 40 Maps a DLL or memory area into another process 12->40 42 Queues an APC in another process (thread injection) 12->42 17 QIaHhSPplFMxY.exe 12->17 injected process7 process8 19 wlanext.exe 17->19         started        22 autochk.exe 17->22         started        signatures9 36 Maps a DLL or memory area into another process 19->36 24 explorer.exe 19->24 injected 26 QIaHhSPplFMxY.exe 19->26 injected process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-09-25 00:42:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nxsaf2ew2dwpnngvl7qp7qnzpdsrdjrsvbbodcbabzolonujgiia._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
220eef253c87c14b996e77c9bf07902a79f83f0ba72770504f1dabeb4ebac820
Formbook
3b2338d420a3ff8d829f3ba666a8a4af8fad2cba584c5b31a9378adaf2947870
Formbook
3b79e392617523720c040a2e0b39f0ff47593a420ecc9edcb9cd8b9e1d7baca6
Formbook
50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7
Formbook
75a9fc79b2513a8964a0dcf3a0749a399a857d3feb2fa3c0d62de6f51ea5971f
Formbook
8326158d0aea2a3ee6a49cc3f88e1c3779eb479790a8b0451133a09c1ca0a777
Formbook
96a3709a8156268f9daaeac2aab9c66146967ef173e5d5d2e8a0ed8bde75ab63
Formbook
a3ac1a13b363264a45374dbc9a485e19f80d71cefa4f3cb72a902d46c667330a
Formbook
a81a0d29652f5c3497d905b124fefc89e7149f61c87b2198872c4dbe8f0c0048
Formbook
bdb41289aeeae3103dae4fa81bdaebb88311bcc6127b1c8c1a9afc96623adbbc
Formbook
+ 40 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230929-k7bjqaae86/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
4e1d0acd8df0963ae1023673fd70de7002e0b09ca934b85599424b3946874b73
MD5 hash:
28639e0149e13d41b1610e84202f72bb
SHA1 hash:
6eebf71af746de9df8923e4e7363e8cf65a492f7
Link:
https://www.unpac.me/results/ad05a052-4749-4391-b148-4dd871b55bcb/
SH256 hash:
a7dbdc2baafb2900d0c7c13a64217b4b5c09fe673631f0b9126c027380d93799
MD5 hash:
8658e3c2989701cced085171fdac955a
SHA1 hash:
e4c7caca0a993bdbfbde6d14d26b22435151ad60
Link:
https://www.unpac.me/results/ad05a052-4749-4391-b148-4dd871b55bcb/
SH256 hash:
9843fe4b257627f51ebcc52ec5ca0b2e7931aada5da844fee0d54109a6b790a8
MD5 hash:
7ec4dc57daee6fa044ee28f0487e7069
SHA1 hash:
cafcf5bc0968dfc4f8bb959982135b0f9df1eac9
Link:
https://www.unpac.me/results/ad05a052-4749-4391-b148-4dd871b55bcb/
SH256 hash:
abed99881ce1e05907653d1697ae232575d0cf067fd5cc646e2e5ee9f7337c82
MD5 hash:
491a7170bd8a7ed81d03a64ff2598bdf
SHA1 hash:
8325a5bccba80878a14032c06b78b34db808b910
Link:
https://www.unpac.me/results/ad05a052-4749-4391-b148-4dd871b55bcb/
SH256 hash:
7ec118e70613ce2d9aee29cda2918ca710dde346c68d4da75c2ea0402e6d4391
MD5 hash:
1622a62bf6805b2dca82a8632eceac71
SHA1 hash:
071b72a5a1231149dfe4b9fcfa3a6ee49265ab7c
Link:
https://www.unpac.me/results/ad05a052-4749-4391-b148-4dd871b55bcb/
SH256 hash:
6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210
MD5 hash:
cdacf3f5255f21aef3d4ef7812bd23a1
SHA1 hash:
aa95561963a9e0ef26a09f4f908f3e0f8f2153b8
Link:
https://www.unpac.me/results/ad05a052-4749-4391-b148-4dd871b55bcb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments