MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83d48e0c93caf20e68768cb684614e74b34b2708bc2f35754e3107db52ea4a80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83d48e0c93caf20e68768cb684614e74b34b2708bc2f35754e3107db52ea4a80
SHA3-384 hash: 69ca1dd74e74aa73f2aff806faaea51b67b25e193febd4fa61e1d0fb9e9727d523b2201a80ee9b1b13d427c09e5aa069
SHA1 hash: 8118ea9051a28b73f54191655c36dfc35805b56a
MD5 hash: a89837682de748b36fa219aaba08c847
humanhash: kentucky-xray-alpha-speaker
File name:Reconfirm bank details.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:709'632 bytes
First seen:2024-06-03 06:46:55 UTC
Last seen:2024-06-03 07:29:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288://OXNuRch74lO8dIcW08OjTdiZXnpM8gtQ++8/G+9skYtpMI+3qY0I:Or4lJ2cn1VopMvyNlcskKpMIi
Threatray 52 similar samples on MalwareBazaar
TLSH T1A3E423E0689FDF38C2DD8BFA50A5050287FD35261676D8C22EF1B2C56D87B64009ED67
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon c48e396949799acc (5 x AgentTesla, 1 x Loki, 1 x Formbook)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
334
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
83d48e0c93caf20e68768cb684614e74b34b2708bc2f35754e3107db52ea4a80.exe
Verdict:
Malicious activity
Analysis date:
2024-06-03 07:05:58 UTC
Tags:
formbook stealer spyware xloader
Link:
https://app.any.run/tasks/87019010-9926-4462-95ea-1196daa9ee40

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Packed2.46843.11425.26474.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=665d799e1b40957fc1932f9awin7simulatehigh_evasion
Tags:
Network Msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/665d66f321581a92819a0cbd/reports/24b45855-a447-434f-807f-0420602f0b56/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/83d48e0c93caf20e68768cb684614e74b34b2708bc2f35754e3107db52ea4a80
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5454f59d-853a-4f20-bd10-4e6f51d7e464
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1450825
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1450825 Sample: Reconfirm bank details.exe Startdate: 03/06/2024 Architecture: WINDOWS Score: 100 28 www.ycwtch.co.uk 2->28 30 www.pricekaboom.com 2->30 32 21 other IPs or domains 2->32 42 Multi AV Scanner detection for domain / URL 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 6 other signatures 2->48 10 Reconfirm bank details.exe 3 2->10         started        signatures3 process4 signatures5 60 Writes to foreign memory regions 10->60 62 Allocates memory in foreign processes 10->62 64 Injects a PE file into a foreign processes 10->64 13 RegSvcs.exe 10->13         started        process6 signatures7 66 Maps a DLL or memory area into another process 13->66 16 fUogwoukXXIm.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 iexpress.exe 13 16->19         started        process10 signatures11 50 Tries to steal Mail credentials (via file / registry access) 19->50 52 Tries to harvest and steal browser information (history, passwords, etc) 19->52 54 Modifies the context of a thread in another process (thread injection) 19->54 56 2 other signatures 19->56 22 fUogwoukXXIm.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 pricekaboom.com 185.31.240.240, 49717, 80 ZONEZoneMediaOUEE Estonia 22->34 36 www.0bi8.fun 107.151.241.58, 49724, 49725, 49726 VPSQUANUS United States 22->36 38 7 other IPs or domains 22->38 58 Found direct / indirect Syscall (likely to bypass EDR) 22->58 signatures14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/83d48e0c93caf20e68768cb684614e74b34b2708bc2f35754e3107db52ea4a80
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83d48e0c93caf20e68768cb684614e74b34b2708bc2f35754e3107db52ea4a80/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2024-06-01 13:49:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qpki4detzlza42dwrs3iiykooszuwjyixqxtk5koged5wuxkjkaa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2483ca984af41c3fc2e5f6bdf8f954dbf5fc7cae277299056064505ae9b1ad07
Formbook
3ef009e7f463f7547633cf58782dc38fe61e38e9e4fcbedf2f70311c6fa0e5a7
Formbook
6fd20150b72d912ef5d75ae8bd7a6776556eada5ed997c0c66e281b36e5f63eb
Formbook
994c2c0d2e853b66344f28f6e25ad27fdf1e456f01f6f77aac29eb7a706bbf6d
Formbook
e154f78539b295e3755ce2a8aaeb11018e35c6471c4584da66260f0365afcd9e
Formbook
+ 42 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240603-hj7wxafc2w/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/502444d8-0917-48ab-9a4f-bb5f1e50cc1f
Unpacked files
SH256 hash:
8b61fbf60b9bfbb53489044100d6fd13911e2066242bd9b6478eeb622b4ddcb5
MD5 hash:
76a0f69d658268c4105c062e979798d6
SHA1 hash:
a461ecdc39dbfd50ecfaad1d129084c5c8a0458e
Link:
https://www.unpac.me/results/93c5d4b0-7cb2-4a17-a38d-66ded304ad85/
SH256 hash:
fb36e835b592e7d7dd9f21db0b12b7fb99eff4d83c981beb66dbe2527399d9e2
MD5 hash:
5eef95ef55462405da2c5f0934832828
SHA1 hash:
01e7d4b5cdf17f6a2098fba3e6674e3bd2edb716
Link:
https://www.unpac.me/results/93c5d4b0-7cb2-4a17-a38d-66ded304ad85/
SH256 hash:
fe442f1595031e35b4bbf9aa5cbc7e601fe00cd2e242013b95d2e81e1a832bff
MD5 hash:
83ba2939f84e7791b3b061dbdce44293
SHA1 hash:
facba36417db1ca12197d0b9a60012f1752412a1
Link:
https://www.unpac.me/results/93c5d4b0-7cb2-4a17-a38d-66ded304ad85/
SH256 hash:
aae920669816646b4e0ac4a604482bd7803cad33aa31eb39b0e5661900b97df9
MD5 hash:
6ee07543aa79d4a0387c5167aab308dd
SHA1 hash:
c2af6c73d3bbe9232a18143c93f69a23ac07b068
Link:
https://www.unpac.me/results/93c5d4b0-7cb2-4a17-a38d-66ded304ad85/
SH256 hash:
b3e4cc520c7275b9decf4149baef1e63fe34f56a9ca077975e2b2c9932c03095
MD5 hash:
598ec902f71016590c4d60383504dd17
SHA1 hash:
55e1c5202f65d07f783dbcf302c50739a61018d2
Link:
https://www.unpac.me/results/93c5d4b0-7cb2-4a17-a38d-66ded304ad85/
SH256 hash:
83d48e0c93caf20e68768cb684614e74b34b2708bc2f35754e3107db52ea4a80
MD5 hash:
a89837682de748b36fa219aaba08c847
SHA1 hash:
8118ea9051a28b73f54191655c36dfc35805b56a
Link:
https://www.unpac.me/results/93c5d4b0-7cb2-4a17-a38d-66ded304ad85/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/83d48e0c93ca/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments