MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8
SHA3-384 hash: 087bda9c96f006a8aa8c6f79cb51489650de807975a8cd4c88f9596f16b3a0700332e763d55f47907d28cee99e1d66aa
SHA1 hash: b557d4d28dade960f1709dc48276cb6fdb19a09a
MD5 hash: 310e0ecedc626f7098624cbdedc45b0c
humanhash: batman-twenty-cat-burger
File name:7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8
Download: download sample
Signature Formbook
Create hunting rule
File size:195'584 bytes
First seen:2023-07-10 09:37:28 UTC
Last seen:2023-07-10 10:09:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:ArZI1XGIJtv3WAUJLcVnNw4WmswPnQP4iZQCL8kpA3tb+13IkUxmEs3ChDQdIBcw:Q22Ij3WAzyciBgkpA9y14kUkyhDUIBpb
Threatray 100 similar samples on MalwareBazaar
TLSH T12514135021CB49D7D2BA9AB9289F6F97238E877BCD11EF6037542617A070854F33443E
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
274
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8
Verdict:
No threats detected
Analysis date:
2023-07-10 10:45:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/153d6036-b37e-4c4e-a215-1b2899afb791

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/413456/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64abd1812333b198b23a0163/reports/7ef44fb0-b876-4628-93e8-113046308c2f/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c031e461-2d67-4945-8204-afd6cf1be333
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1270244
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-07-10 09:38:08 UTC
File Type:
PE (Exe)
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pw2owcov4o33rszxkojjlwqbscy4cqlitcaewkl6dpd3l5pp7hua._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2cd9e8fc5b73c35422b79574233937370a03f6714ba9e813da80ac2974b4cf91
Formbook
3bfaaf7436f93dff822a8c0f81f2e805f1c6855da29e1ee3ddd6d18c04744ae8
Formbook
4053220e58d30e514ab543a64e3854e7c411bfa084c000172cdfe6d3e8f65875
Formbook
455479a2d31bd901fdff62e67ec93e40f80e5956384e93e5030132d4a490501f
Formbook
5069d4603ed9201d98988deb46e1e5627d622f47a498b3decb96ae1b02da3496
Formbook
7c397e8792e6dbc64b6d5fd80a2ed4d82e76c1e0e9d7a262f089e1c1e8c438df
Formbook
99cd4e51fb0f2d9ba76ee4d12afd5c3cd096f0c390ecf657ea3a3d78158451ef
Formbook
c1e64e86dd89a5820bbb518ead2176741f91d3bf5c579e154533d44e816c1f76
Formbook
cd0120b7c1d114b73fd768a37de9e2c34fb1662a3e1dc620b34763410ccb6d7e
Formbook
d434a9f3609e63a13feafd0bc3bf29abac38d194b72220d9e51054abdaf84826
Formbook
+ 90 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230710-ll3lraae5y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
94bc3d86d119fa00eea934d96dc0892aaf08a700c1a6edff3dbd4b59de748d88
MD5 hash:
437e059e0a26d14a6a0764b8fcf48fb9
SHA1 hash:
ba8582f66b98ff3accc5500686a6e286f9324582
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/72575ebf-6601-449a-bb96-a7059ace7181/
SH256 hash:
7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8
MD5 hash:
310e0ecedc626f7098624cbdedc45b0c
SHA1 hash:
b557d4d28dade960f1709dc48276cb6fdb19a09a
Link:
https://www.unpac.me/results/72575ebf-6601-449a-bb96-a7059ace7181/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7db4eb09d5e3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/413456/

Comments