MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e6de0048abf36ec04607f8277fe0c3ce7e9232d4147bdeb8b214d49d19091c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e6de0048abf36ec04607f8277fe0c3ce7e9232d4147bdeb8b214d49d19091c7
SHA3-384 hash: 20950e8ddb6d377f872e77ef1ea4179020449affd24beb48aad3fcb621a6ab4cb6408a0d04c47afc1147c5ba3ca472a4
SHA1 hash: d12a969dab1cb385fd34593759c923cd48cc55c0
MD5 hash: 2245ba729d9b9cb1ee2be35a736ddc41
humanhash: uranus-cardinal-friend-river
File name:r4824_230523090902_001.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:805'888 bytes
First seen:2023-05-29 16:00:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:ZsFbsfI8Z1gMFVobi/WYYZH6Ir293sb+Sei4NZwiiM4kFeK/fVTdHxcRNwS5q:Z0bsfI6dFqbLMIr2VUf4NfR4WNTD2
Threatray 1'462 similar samples on MalwareBazaar
TLSH T105051289631356B7FBB812B117A2A2108DA4EEFE9071D6E7FF01179E9D4230625723D3
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter FXOLabs
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
r4824_230523090902_001.exe
Verdict:
Malicious activity
Analysis date:
2023-05-29 16:00:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f07f7bb8-13cb-4988-b8da-44b47a3787bb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/393122/
Detection(s):
SecuriteInfo.com.Win64.PWSX-gen.24919.20418.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a file
Сreating synchronization primitives
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6474cc5d8d9b5a6c973f8f19/reports/f9da968b-5025-4995-b864-6735204809f3/overview
Verdict:
Malicious
Labled as:
MSIL/Kryptik_AGeneric.AUL trojan
Link:
https://www.hybrid-analysis.com/sample/8e6de0048abf36ec04607f8277fe0c3ce7e9232d4147bdeb8b214d49d19091c7
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/225ad91a-b7f9-45ca-bff9-13a08b4d8c5e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1244565
Signature
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 877571 Sample: r4824_230523090902_001.exe Startdate: 29/05/2023 Architecture: WINDOWS Score: 100 21 Malicious sample detected (through community Yara rule) 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 Yara detected FormBook 2->25 27 4 other signatures 2->27 6 r4824_230523090902_001.exe 3 2->6         started        process3 file4 19 C:\Users\...\r4824_230523090902_001.exe.log, CSV 6->19 dropped 29 Writes to foreign memory regions 6->29 31 Injects a PE file into a foreign processes 6->31 10 AddInProcess32.exe 6->10         started        13 aspnet_wp.exe 6->13         started        15 aspnet_regbrowsers.exe 6->15         started        17 cvtres.exe 6->17         started        signatures5 process6 signatures7 33 Maps a DLL or memory area into another process 10->33
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e6de0048abf36ec04607f8277fe0c3ce7e9232d4147bdeb8b214d49d19091c7/
Threat name:
ByteCode-MSIL.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2023-05-29 06:03:04 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
6
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzw6abekx43oybdap6bhp7qmhtt6siznifd3324lefgutumqshdq._file
Verdict:
malicious
Similar samples:
0dfc6c7df7c32bb5212def47800d68f6f3168f284489fffb02b723da2d284c39
Formbook
13e85a56084b5afcf6030fbaee89e2c49b5616eb8f7f5da934f11547b2df2d10
Formbook
3b185f9e2349e436272277d50a22df609a8253d0fafb2c53ea003083b2196689
Formbook
3cddb05d117f03417a4605b4c3666277ad299b9c4e4f17e6a9248d501dd84161
Formbook
577a6f8ac673a1b176fd32c9b8fe01178fee10a2602e3ccbc02b3fdebfa9bf0b
Formbook
84efc33351ff38b37075c0c4eecb8caa32c803ed1fcadbc128705385a85209ee
Formbook
88d0963292143c5ba31261b14fa12f59edcd78df1bea35281e8cf080aa1460c0
Formbook
91ac5e95c271f56efcf7f8c2f1ce27579242a2cdca317fd11bf7ff380c9750ed
Formbook
bc9a80c327839012274d763d66186497685a6b73e0b20eea73c720d61f5c9407
Formbook
e405f3facfec4741b7a25d5490bf7fe55ba525f4d17706a6e3d8b00b2a725025
Formbook
+ 1'452 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230529-tf7yaace76/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Unpacked files
SH256 hash:
8e6de0048abf36ec04607f8277fe0c3ce7e9232d4147bdeb8b214d49d19091c7
MD5 hash:
2245ba729d9b9cb1ee2be35a736ddc41
SHA1 hash:
d12a969dab1cb385fd34593759c923cd48cc55c0
Link:
https://www.unpac.me/results/1a16bbce-e47f-4138-a06f-35db90c618a7/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8e6de0048abf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e6de0048abf36ec04607f8277fe0c3ce7e9232d4147bdeb8b214d49d19091c7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 8e6de0048abf36ec04607f8277fe0c3ce7e9232d4147bdeb8b214d49d19091c7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/393122/

Comments