MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4
SHA3-384 hash: b556e2da61cdf8ed0c5d721b54711237d87c044ab7e11c32f7efd522c7823e0448cde65bfe4e0316793ac27a1b7478be
SHA1 hash: 1c2571c105ff2fd47d1599d55c67f360c9f12ae3
MD5 hash: d545cdef214d98a80e5ef01ac3367049
humanhash: eighteen-iowa-yellow-nevada
File name:PO2235AE3.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:815'616 bytes
First seen:2023-05-07 14:32:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:Zs11KporyhvjBclcOzG8NqjN9HCyMpeiAPKH5r3laoayGqJEmK:yPKpoGhv6eOzRNmHCy1VyH5DlbG7m
Threatray 2'734 similar samples on MalwareBazaar
TLSH T12105F12533B9B791ECF683F86608E4016FB46D6057B6D6E84DCAE0CD9194F18B700BA7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter TeamDreier
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
255
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO2235AE3.exe
Verdict:
Suspicious activity
Analysis date:
2023-05-07 14:34:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/310ac4d8-921c-455a-be0b-be254ac18600

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/387325/
Detection(s):
SecuriteInfo.com.Variant.Lazy.339156.24114.19452.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo jigsaw packed
Link:
https://www.filescan.io/uploads/6457b6a4d76c8c7b476e32f9/reports/8c2854b3-56e3-42f6-a9f6-2301db9b7c22/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f5886b30-6939-4bed-8c03-ec74b7742be8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1227828
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-05 06:35:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4jt4y4d3lpyglf3bynn2m5bvjcaw7zibju5mubygiyetunhnp2a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
04641e247441a72cb287998b6f36b49959d43cfef538dd806aea04a8606817fb
Formbook
2c41ec55217c805b8a73085daa06089d01cd601d1bc16a0099be113222e0446b
Formbook
3674a39f9ada533ddff15f070a08cb1b9761877d5193e86b215811214250a394
Formbook
49daade32a02cad550a909add48d98aac63ac1cccf729758d7099975ad25ca82
Formbook
73d1e3aef89f5422a3ef99c1b182cb87a9aac77654ec40d849b8f4f675ada622
Formbook
81fa240a670be8c74e02896fea0dcfed18383b2246a3ad53f7afd71487de1798
Formbook
833a839bf412c22e06f2a3c0622e460df8fc5edbf55cdad09e7b76d5d73dacaa
Formbook
aa3a5e3035f1281d3a412956e0a0273d33e0f07500abc909eb5d9dad6524b588
Formbook
b5f2e0b49faad7f9714d0b1088965647eb83d8772b234555738bcea1094dfd2f
Formbook
+ 2'724 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230507-rwvlsaeh96/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
72cc5f1c7dfee6ddc819c225cdc5b67f420df1cea6ed1d5fd6dc8b4a9db16809
MD5 hash:
cea6d046843a5e5bf4b9badff15faf8b
SHA1 hash:
a8b6e8ea5b1c212cc969ed4aaa791b470f9b3948
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/3c9be2b8-e56e-4d19-82a5-4fa4923582fb/
Parent samples :
04641e247441a72cb287998b6f36b49959d43cfef538dd806aea04a8606817fb
77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4
SH256 hash:
774815f05690d68525dc42542ce9caa4ba63652338787318340f41ef61ed7d2f
MD5 hash:
875b5743fb0f010fd133eba77dbf65bc
SHA1 hash:
bc748a38387576cd7ff0a7d43337b7970f0d794a
Link:
https://www.unpac.me/results/3c9be2b8-e56e-4d19-82a5-4fa4923582fb/
SH256 hash:
f1a9401355ddf01cac40cce7fbe818a38705c73c48736f0916887e21e77a7fb6
MD5 hash:
d071aa3c5858a0683d20a7682b197140
SHA1 hash:
e96cff2c5aeb6e1fcf94c9204e0992908c36b514
Link:
https://www.unpac.me/results/3c9be2b8-e56e-4d19-82a5-4fa4923582fb/
SH256 hash:
ef7122a98eca35c197740b6d6e1905c446a9d65fd1580f8fb3274d85151e5245
MD5 hash:
f4ff5b1b1dc7d2cc8c440f83bce82f8b
SHA1 hash:
e15b4dd8354139fbfefc4c63bfde8311da9f226f
Link:
https://www.unpac.me/results/3c9be2b8-e56e-4d19-82a5-4fa4923582fb/
SH256 hash:
0b334837beeaa02b54302f8449ef87fb3f855ede651d3ade3d6ef7fc3694547a
MD5 hash:
d1ce90e238438afde960530f586814fb
SHA1 hash:
d8b450e4bf254633296a0959edf6f1528d711c35
Link:
https://www.unpac.me/results/3c9be2b8-e56e-4d19-82a5-4fa4923582fb/
SH256 hash:
e5518e76f14e87bcc58a705c6f8f3a686cbffefc0e55985d17a067adfddf3688
MD5 hash:
920a2854e9c183ad2ef7d5543c296d38
SHA1 hash:
2c20da753bdf6f1a46261e2c132dd42f75c94229
Link:
https://www.unpac.me/results/3c9be2b8-e56e-4d19-82a5-4fa4923582fb/
SH256 hash:
77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4
MD5 hash:
d545cdef214d98a80e5ef01ac3367049
SHA1 hash:
1c2571c105ff2fd47d1599d55c67f360c9f12ae3
Link:
https://www.unpac.me/results/3c9be2b8-e56e-4d19-82a5-4fa4923582fb/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/77133e6383da/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/387325/

Comments