MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
SHA3-384 hash: 51f5746dba856d910205fc09b791e02e6da51bb70c6540e41f3c23b52c430918b4d993047dbc11753a0479e25a0a0508
SHA1 hash: b4fbf0aab8d2695231ee54615c60a917bf9ad2cd
MD5 hash: 9cd889e65235a00e96a92e4304307f53
humanhash: spring-sixteen-west-island
File name:9cd889e65235a00e96a92e4304307f53
Download: download sample
Signature Formbook
Create hunting rule
File size:992'768 bytes
First seen:2023-08-23 05:56:53 UTC
Last seen:2023-08-23 06:33:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:NS9lCe9qhJ4pdsEQ2ZM5R1HuimkVZPmkgPV4dfTL4:SlCe9qhJ4peLgMr5THLekgOZk
Threatray 1'725 similar samples on MalwareBazaar
TLSH T12D250126B2A6DF05C67CC3F190512F84635746CE1175F2784CC6A4EAB2EABC24E529F3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
356
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
5890796959.xls
Verdict:
Malicious activity
Analysis date:
2023-08-22 07:53:56 UTC
Tags:
opendir exploit cve-2017-11882 loader formbook stealer spyware
Link:
https://app.any.run/tasks/4013c123-e0be-4b87-a99c-78bcf8967678

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/444278/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.2290.16709.7992.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Restart of the analyzed sample
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1874f26b-4e38-4f3d-8391-5e63ef016ce3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1295658
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Deletes itself after installation
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1295658 Sample: 9t0qjhF7ce.exe Startdate: 23/08/2023 Architecture: WINDOWS Score: 100 31 www.yh66985.com 2->31 33 www.workationdelsol.com 2->33 35 15 other IPs or domains 2->35 43 Snort IDS alert for network traffic 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus detection for URL or domain 2->47 49 6 other signatures 2->49 10 9t0qjhF7ce.exe 3 2->10         started        signatures3 process4 signatures5 61 Injects a PE file into a foreign processes 10->61 13 9t0qjhF7ce.exe 10->13         started        16 9t0qjhF7ce.exe 10->16         started        process6 signatures7 63 Maps a DLL or memory area into another process 13->63 65 Sample uses process hollowing technique 13->65 67 Queues an APC in another process (thread injection) 13->67 18 qpaElAHPPss.exe 13->18 injected process8 process9 20 msiexec.exe 13 18->20         started        signatures10 51 Tries to steal Mail credentials (via file / registry access) 20->51 53 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 20->53 55 Tries to harvest and steal browser information (history, passwords, etc) 20->55 57 5 other signatures 20->57 23 explorer.exe 7 1 20->23 injected 27 qpaElAHPPss.exe 20->27 injected 29 firefox.exe 20->29         started        process11 dnsIp12 37 acdaiucdac.com 165.140.70.70, 49733, 49734, 49735 WISCNET1-ASUS Reserved 23->37 39 www.playcups.life 203.161.58.192, 49720, 49721, 49722 VNPT-AS-VNVNPTCorpVN Malaysia 23->39 41 9 other IPs or domains 23->41 59 System process connects to network (likely due to code injection or exploit) 23->59 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-08-21 11:47:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rycqaapg7mpfwoxdn2vfqxim3udv3wapwrgpw7gwybmnua6hcatq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
20d45ab8062d59db6229e293a604f37e2760519894d07380288f0f8f5e2b5c95
Formbook
5348bcccead193b46acc11339b9c3ff05395753d536a0952641af34382e08604
Formbook
5e0519cad57279ab39f475c7ec22d2435a4a69f2378cf2254745e089f5c174fb
Formbook
6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
Formbook
72d3a95a59ccd8220e04850fb54fdc48caa51c10739d96afa48ab5446303dc07
Formbook
8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
Formbook
9e9af76a8585a7b99a59f042f64a711aaa8f9bfb68a4040ca522147470d6b6de
Formbook
c7616a546f8e22dd0a80b275f5991b6c6ab567d278be339904d6bff0c5c00a42
Formbook
fed8358d2eb6cd687bb6f6a88b4f8bc01bd5dcf355535532718a0f04f1eff674
Formbook
+ 1'715 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230823-gnk29sbf7x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
341600e5fe8f53faf04eadc6390e471dc2444ab28691514af8b74c8b561d9a5b
MD5 hash:
67663152c1f736896ce8322eafc835ff
SHA1 hash:
4820664daf28d13d8c9ca922fd86d46c6eb7bff1
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/aa397829-1b4a-4177-954e-0c55594d256d/
Parent samples :
8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
6510c3886e8ddeb0b7b164f915cdb5af33622d9f662b4ef814679e75657daff1
fed8358d2eb6cd687bb6f6a88b4f8bc01bd5dcf355535532718a0f04f1eff674
c7616a546f8e22dd0a80b275f5991b6c6ab567d278be339904d6bff0c5c00a42
9e9af76a8585a7b99a59f042f64a711aaa8f9bfb68a4040ca522147470d6b6de
72d3a95a59ccd8220e04850fb54fdc48caa51c10739d96afa48ab5446303dc07
5348bcccead193b46acc11339b9c3ff05395753d536a0952641af34382e08604
20d45ab8062d59db6229e293a604f37e2760519894d07380288f0f8f5e2b5c95
adf4ca6996042eb10e2cb46b72dd67d5640e30c945b90e9adc8f627330f8690c
a0c810baccbd3943748568d16e5b9cdf6b829364c8e4b21cda09c4f865b228f0
5e0519cad57279ab39f475c7ec22d2435a4a69f2378cf2254745e089f5c174fb
8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
395c0801560221dfb7b4f709c1c4023bb807be25027074ab97ac8693e293b381
31fd5ab4ff38fd42399d4d90a19da71b94cd7ba47b0a97ce1bda37958ce97ef6
SH256 hash:
78eaae7f782e4b12d7d47f290ddaae74c19373393bb86673fb25633b7fcbc7c9
MD5 hash:
be26954f9951b84a519797424fc52ee1
SHA1 hash:
8228036eb552bf7679f37cbd463d3f911d29964e
Link:
https://www.unpac.me/results/aa397829-1b4a-4177-954e-0c55594d256d/
SH256 hash:
2ac2f55e15fd8da559f99925ceee9166ca978e94cbc53a5cb29bf02d0a76ac7f
MD5 hash:
1081db0b25581c7958e6fbff4d9aa64a
SHA1 hash:
bcb0e0fe844884a5b0d05cd3b0cc5fd7a5ff53b9
Link:
https://www.unpac.me/results/aa397829-1b4a-4177-954e-0c55594d256d/
SH256 hash:
080c5c98c03a635e0e5277442990cadd36b401d90edadc74fe9e761998966485
MD5 hash:
70e13a3537bf8022542b5d0457d02d82
SHA1 hash:
b24da55f1863a1f2f623a66ff915e2d9260c1309
Link:
https://www.unpac.me/results/aa397829-1b4a-4177-954e-0c55594d256d/
SH256 hash:
a6e9624cda1557a0d52b97b2a18a2ca636f68a114e3586849e66b0a815638d10
MD5 hash:
b5470c01f8cbd8a090355950bf347f83
SHA1 hash:
6784b2e9c07c000e8193e14c623fb2f9cead789b
Link:
https://www.unpac.me/results/aa397829-1b4a-4177-954e-0c55594d256d/
SH256 hash:
8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
MD5 hash:
9cd889e65235a00e96a92e4304307f53
SHA1 hash:
b4fbf0aab8d2695231ee54615c60a917bf9ad2cd
Link:
https://www.unpac.me/results/aa397829-1b4a-4177-954e-0c55594d256d/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8e050001e6fb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2706342/
Cape
Cape
https://www.capesandbox.com/analysis/444278/

Comments


Avatar
zbet commented on 2023-08-23 05:56:54 UTC

url : hxxp://103.16.225.211/M218T/wininit.exe