MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74fc7f4f9d1789c40449c4e0536f8a77ca7c46d7c748fce0caf8b8f57982e291. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74fc7f4f9d1789c40449c4e0536f8a77ca7c46d7c748fce0caf8b8f57982e291
SHA3-384 hash: 734a1e811bc2f88f24e285e7670fe0601a59d512fd7c4ebdb7db10370a45a24ad377cb93744ce3fc23ecd26a0f51f65f
SHA1 hash: 0ae0179f5ee2a7a25e54357f98b31240e98f5c45
MD5 hash: 98b3dbde5bd59536650bff9e88df827a
humanhash: magazine-oscar-purple-winter
File name:Payment Receipt for Customer-PH00236855_PDF.vbs
Download: download sample
Signature Formbook
Create hunting rule
File size:285'696 bytes
First seen:2024-04-16 15:32:03 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 6144:L5dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOeG8a/XvFas:1nS2Im7f/gzTM
Threatray 478 similar samples on MalwareBazaar
TLSH T14A544BA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED54
Reporter abuse_ch
Tags:FormBook vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cerberus finger lolbin masquerade obfuscated powershell
Link:
https://www.filescan.io/uploads/661e9a3275339da04f935f16/reports/e9d732a8-932c-46ee-b8ba-a769a20f8c16/overview
Verdict:
Suspicious
Labled as:
VBS/Agent.RUX trojan
Link:
https://www.hybrid-analysis.com/sample/74fc7f4f9d1789c40449c4e0536f8a77ca7c46d7c748fce0caf8b8f57982e291
Result
Verdict:
MALICIOUS
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1426840
Signature
Antivirus detection for URL or domain
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Potential malicious VBS script found (suspicious strings)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Writes or reads registry keys via WMI
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AgentTesla
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1426840 Sample: Payment Receipt for Custome... Startdate: 16/04/2024 Architecture: WINDOWS Score: 100 31 mail.myhydropowered.com 2->31 33 ip-api.com 2->33 35 4 other IPs or domains 2->35 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 Antivirus detection for URL or domain 2->57 59 10 other signatures 2->59 9 wscript.exe 1 2->9         started        signatures3 process4 signatures5 61 VBScript performs obfuscated calls to suspicious functions 9->61 63 Suspicious powershell command line found 9->63 65 Wscript starts Powershell (via cmd or directly) 9->65 67 3 other signatures 9->67 12 powershell.exe 14 18 9->12         started        16 WmiPrvSE.exe 9->16         started        process6 dnsIp7 43 drive.usercontent.google.com 142.251.15.132, 443, 49735, 49740 GOOGLEUS United States 12->43 45 drive.google.com 64.233.176.100, 443, 49732, 49739 GOOGLEUS United States 12->45 77 Suspicious powershell command line found 12->77 79 Very long command line found 12->79 81 Found suspicious powershell code related to unpacking or dynamic code loading 12->81 18 powershell.exe 17 12->18         started        21 conhost.exe 12->21         started        23 cmd.exe 1 12->23         started        signatures8 process9 signatures10 47 Writes to foreign memory regions 18->47 49 Found suspicious powershell code related to unpacking or dynamic code loading 18->49 51 Hides threads from debuggers 18->51 25 wab.exe 15 8 18->25         started        29 cmd.exe 1 18->29         started        process11 dnsIp12 37 mail.myhydropowered.com 131.226.2.60, 49743, 587 UNASSIGNED United States 25->37 39 ip-api.com 208.95.112.1, 49742, 80 TUT-ASUS United States 25->39 41 api.ipify.org 172.67.74.152, 443, 49741 CLOUDFLARENETUS United States 25->41 69 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->69 71 Tries to steal Mail credentials (via file / registry access) 25->71 73 Tries to harvest and steal browser information (history, passwords, etc) 25->73 75 2 other signatures 25->75 signatures13
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/74fc7f4f9d1789c40449c4e0536f8a77ca7c46d7c748fce0caf8b8f57982e291
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74fc7f4f9d1789c40449c4e0536f8a77ca7c46d7c748fce0caf8b8f57982e291/
Threat name:
Script-WScript.Trojan.Guloader
Create hunting rule
Status:
Suspicious
First seen:
2024-04-16 09:36:10 UTC
File Type:
Text (VBS)
AV detection:
2 of 23 (8.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ot6h6t45c6e4ibcjytqfg34ko7fhyrwxy5epzygk7c4pk6mc4kiq._file
Verdict:
unknown
Similar samples:
086fd488622c16461d2c60ca3cd42a7d5147978f1624e51a04c7ceedcaa71c6c
Formbook
0920bc3a9993954c4c2f092677b4a629be306568d7d8226b24c516ffb069f41e
Formbook
19593fb0eb17b04d214f834a817caebadd4ea02b52d6a0fb913aa7e80adfaa91
Formbook
33d004dfe611ea39e022f1373189184c9bbc5866eccdf2ada38a794fbe717fc6
Formbook
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34
Formbook
4468fe52ea5aeb3bb0673ea101f9989fe4a1ea3ee8f729c64f56f66324e94988
Formbook
46ccb3436fbd93182c0196510c4b8451e539560d2d68e1338db7720676e0b637
Formbook
5fd79e8094fb1ac9dbc167219bc3218cf07a5679edc11f7847c5cd0b2e756309
Formbook
98ac0a744497cf22f08ae5e2e49eba547253f7824b2a76ecfd7cf786dd1b34ce
Formbook
ccab68b5a4548b426960ac5e57511c5511f84868bb28b8a5ebd080632b5cf815
Formbook
+ 468 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240416-sy7jssdf52/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Blocklisted process makes network request
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/74fc7f4f9d1789c40449c4e0536f8a77ca7c46d7c748fce0caf8b8f57982e291

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cerberus
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Cerberus
Rule name:unknown_dropper
Create hunting rule
Author:#evilcel3ri
Description:Detects an unknown dropper

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments