MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73a8edb10431e28b5accb188cfc72d781112cc710b0b5fe80e1a913bc6022030. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73a8edb10431e28b5accb188cfc72d781112cc710b0b5fe80e1a913bc6022030
SHA3-384 hash: 6601edb4f9fb19121bc5091f115e66d46abb0c570832cdc0474e962f3c1b35a501a07fb6427ff7fbc120fd4c8f0b98be
SHA1 hash: cea91a4c666f5856ea84b895bfeecb6a79e863e3
MD5 hash: a9f246ff463d8547fbe9f3cac818b1a2
humanhash: tennessee-west-arkansas-jig
File name:a9f246ff463d8547fbe9f3cac818b1a2
Download: download sample
Signature Formbook
Create hunting rule
File size:813'056 bytes
First seen:2022-07-20 13:50:53 UTC
Last seen:2022-07-23 02:47:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:8/Nl0wo1dI8w2hDyC13LJcn6OCMFkNKM:Gl0V1ymDyCRJc6O9F
TLSH T1E805010132BC6F93C9BD97FA5465608103F61A5B722DE7584ED3B0DF2A36F814A60E4B
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
282
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/292939/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.44341.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62d8084c8fbcdde3606035d0/reports/edcb7fca-9d6b-4907-9753-c8df20346761/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1037571
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/73a8edb10431e28b5accb188cfc72d781112cc710b0b5fe80e1a913bc6022030/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-07-20 08:53:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
21 of 26 (80.77%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oouo3mieghriwwwmwgem7rznpairftdrbmfv72aodkitxrqceaya._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/220720-q5sywagbdk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
6a3793f90648d3d204e58f869398b94866bf663cbbe68b933270fa2444c30c0c
MD5 hash:
b0bfaff11bc233516e6a4267ecd3cdd4
SHA1 hash:
f70e0d62437b04c3ffeec539fdf931195594dbac
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/515ac020-c62c-45c5-9d94-0289a7730310/
Parent samples :
f07d53c83cb9581c5f985995a474ca80ed8bed03f3f1e80850471787953aef25
feb36d0d6cc31e013c681045838349e4c3dcb58cf98b2e3f5d1529666aa8a7e3
73a8edb10431e28b5accb188cfc72d781112cc710b0b5fe80e1a913bc6022030
f9fb589052566428a67d48a810267affa760946834ddccc4d18d2ad5b5dff3a6
613edebe9f20eff6958bc447fa000388c1b986e1cdb76930ca061d2c92fe952c
a7faadb4d704458a8a6c719fc4143dbe9f23e7ee87bdd67ae607311b29860154
46bbfe087bb81dd0b199bdb140282512d7eb65fa60abc01d460f83881d3beb15
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
Link:
https://www.unpac.me/results/515ac020-c62c-45c5-9d94-0289a7730310/
SH256 hash:
f14d6e4175a838fe09c009306b4ecfe940626cb8187c7b839ff2e0c54ebb5bac
MD5 hash:
1c9b1b0b510217d47b0412c6ebedfe1c
SHA1 hash:
c2d7c059aa8252717b4fc8cddc19dcff72be3647
Link:
https://www.unpac.me/results/515ac020-c62c-45c5-9d94-0289a7730310/
SH256 hash:
a903b4de52d40e3381934f6975b08097224e9e3b707a3c0c8706b1007f143234
MD5 hash:
e8a70e508138f95df9d86ce8ae8e7d22
SHA1 hash:
89033cb8ca82bb60c5013cb615c4fbc33f57a181
Link:
https://www.unpac.me/results/515ac020-c62c-45c5-9d94-0289a7730310/
SH256 hash:
781c78f48dc35cb66432bd1826965cc59fb100d4d12c04432a2c92361f8364c3
MD5 hash:
4bfe50310c7b0dd87da13cc6109f0190
SHA1 hash:
2e3cfcf114927e004ea7788b29e5dc45c5f9e246
Link:
https://www.unpac.me/results/515ac020-c62c-45c5-9d94-0289a7730310/
SH256 hash:
73a8edb10431e28b5accb188cfc72d781112cc710b0b5fe80e1a913bc6022030
MD5 hash:
a9f246ff463d8547fbe9f3cac818b1a2
SHA1 hash:
cea91a4c666f5856ea84b895bfeecb6a79e863e3
Link:
https://www.unpac.me/results/515ac020-c62c-45c5-9d94-0289a7730310/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/73a8edb10431e28b5accb188cfc72d781112cc710b0b5fe80e1a913bc6022030

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 73a8edb10431e28b5accb188cfc72d781112cc710b0b5fe80e1a913bc6022030

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2259320/
Cape
Cape
https://www.capesandbox.com/analysis/292939/

Comments


Avatar
zbet commented on 2022-07-20 13:50:55 UTC

url : hxxp://208.67.105.179/oluwazx.exe