MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200
SHA3-384 hash: cb18aab0d090f5364a27cbe906a3e6d26b4d8d11689963ea3e1582fc379dca74c44609bf0d59dedbbc98e115cac5161d
SHA1 hash: 0e8ba089874b1712f080c762e98b9cb6e3a4b1dd
MD5 hash: bfcc7c29b09747aaf19d959f3a2840ee
humanhash: sierra-ohio-princess-iowa
File name:Payment Slip.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:735'744 bytes
First seen:2023-05-22 08:55:12 UTC
Last seen:2023-06-05 11:03:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:CvV+s1bSQT6tjjdB4SE4uryvTAed4aI6Qt2Pli/LwNEMz8X5HlKtxp5udJF5VOz:CtMLuwTAeeaI6A/LuAXaIJPVO
Threatray 3'000 similar samples on MalwareBazaar
TLSH T13EF48B5233B57621F47D33FD0129638DCB39B44A2122E22A1F563AC556E27EB770A2D3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
6
# of downloads :
251
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Payment Slip.exe
Verdict:
Malicious activity
Analysis date:
2023-05-22 08:59:28 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/3ce489ab-c57f-4f77-95e3-661badcca757

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.25342.26931.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/646b2e22cf0434aa10b606fb/reports/fe13402f-8195-448a-942b-a10e02b8e8e3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/c865ba96-ab8b-4b6c-9010-011055df0c83
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1239437
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 872436 Sample: Payment_Slip.exe Startdate: 22/05/2023 Architecture: WINDOWS Score: 100 70 Snort IDS alert for network traffic 2->70 72 Found malware configuration 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 9 other signatures 2->76 10 Payment_Slip.exe 7 2->10         started        14 kIjndLR.exe 5 2->14         started        process3 file4 48 C:\Users\user\AppData\Roaming\kIjndLR.exe, PE32 10->48 dropped 50 C:\Users\user\...\kIjndLR.exe:Zone.Identifier, ASCII 10->50 dropped 52 C:\Users\user\AppData\Local\...\tmp1A5C.tmp, XML 10->52 dropped 54 C:\Users\user\...\Payment_Slip.exe.log, ASCII 10->54 dropped 84 Uses schtasks.exe or at.exe to add and modify task schedules 10->84 86 Writes to foreign memory regions 10->86 88 Adds a directory exclusion to Windows Defender 10->88 16 RegSvcs.exe 10->16         started        19 powershell.exe 21 10->19         started        21 schtasks.exe 1 10->21         started        90 Multi AV Scanner detection for dropped file 14->90 92 Machine Learning detection for dropped file 14->92 94 Injects a PE file into a foreign processes 14->94 23 RegSvcs.exe 14->23         started        25 schtasks.exe 1 14->25         started        27 RegSvcs.exe 14->27         started        signatures5 process6 signatures7 62 Modifies the context of a thread in another process (thread injection) 16->62 64 Maps a DLL or memory area into another process 16->64 66 Sample uses process hollowing technique 16->66 68 2 other signatures 16->68 29 explorer.exe 2 1 16->29 injected 33 conhost.exe 19->33         started        35 conhost.exe 21->35         started        37 cmmon32.exe 23->37         started        39 conhost.exe 25->39         started        process8 dnsIp9 56 despachocontablequinsa.com 162.241.2.113, 49711, 80 OIS1US United States 29->56 58 www.kickskaart.com 104.21.46.181, 49710, 80 CLOUDFLARENETUS United States 29->58 60 www.despachocontablequinsa.com 29->60 96 System process connects to network (likely due to code injection or exploit) 29->96 41 mstsc.exe 29->41         started        98 Tries to detect virtualization through RDTSC time measurements 37->98 signatures10 process11 signatures12 78 Modifies the context of a thread in another process (thread injection) 41->78 80 Maps a DLL or memory area into another process 41->80 82 Tries to detect virtualization through RDTSC time measurements 41->82 44 cmd.exe 41->44         started        process13 process14 46 conhost.exe 44->46         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-05-22 08:34:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sou6vat53brvcwf6pmihuqh65nikkjlgngerl4getgs7kdavoiaa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
03c2c605e315b7589bd9f386579027ad31d4014d5dc3d48ca9a446a5e53a3afc
Formbook
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
Formbook
2484f3b9e112f39471b0375d98ac190b4ffe3e29a295bcecdb8fd7b71af0094b
Formbook
320c4584c3d392006ef443e5743123a45909fbae309c7561ced8fac11e11e5d3
Formbook
3fe2c04c33423019af7464d50b3df0775a565e9a31e1a289b49e4e180585ab00
Formbook
76a59267c8c6b0e6878ad01204e5971c46726bcdb41bd74818b038baa597e027
Formbook
7d0fdf3abd56e00933c0fa8cf573b948a4c9d85248915249f1909e6775f75e75
Formbook
9bfcddc5558b99ca104647f9f65f6eeb585d7eada6a786e841ff71d9a7a4c682
Formbook
9d2fe317d804de453747ca99b16054d206513ad14a7f4ce8a2507db982fcb533
Formbook
a28cb539852da2e100484ab8cee9613a28b2e68d409b99d80e27f4fb7f238b5d
Formbook
+ 2'990 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:m82 rat spyware stealer trojan
Link:
https://tria.ge/reports/230522-kv1m3sfb95/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook payload
Formbook
Unpacked files
SH256 hash:
76f9c3ed177a98a5397d5507ce7efbafed0c55553ce00dec171891c54a35db77
MD5 hash:
d090b96080246effb57d59eba08ce4c8
SHA1 hash:
b77aa76796ff76824ce7c7ca4cf11378888f1d44
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/9819e228-5a12-4c2b-9db3-e349f4fd6128/
Parent samples :
89d2909907c3d2b6d07e0b7cec15705f783ec6df833ca12ef42eeb7c147686cf
34a5fa7d85900b14812e17b83238dd9b6e8a4b65373d06c7274c2c03ab418e36
b00b40c7ac573bb276450271e73d9c30ba49a7378f5c991fd518c9d3870f6823
f874095f50064aa4f4405f045c8ca3640812609167138cd7137816cb8f774994
a25247a44c6daf029eae02060c11c9a946d0648f2eedc1a6348822c7c6590af3
b600964a8820087cca83e668feeb9096d3aa9e2dbfdaf8a6546d8ec57d52b876
895f56ac536039f2b575b9013cd2d756d48f2fd6ecab01689f33b1d18598452d
7ae7549fcc35a02ed81ab68dbb4997b955edd32cc0207f9e58199200d82e281a
7b222afd2a90cd509e30c2d7bb748e2de92feaba064da9acfa84ac7684768d72
338c24b4e755ad15fa3fba95c2a4df09d8fe2aa343b13dc8d5506013ba8bb94a
d9e6629d10acc5f2c14986434a8ecf599c025ea5250015cb15dea536f05b61e8
787749eb7f58d153e79642ec221d253fc05da6fe31db65e423f14d02ab4d87e5
b8f118372fddf19c9ec290fb43e0c3f8154f45c1d8ec9c119ebd0c8d83b606f0
da43a0b65a0e93951f23754a21119c40e4928cf9c9a6b8d77481b631a01bc9a9
96f77abb1ac5786997e5bbe93b32245c169590855924a12a92c014051758ec8a
24380c6d7b340557a8e71c58078bd0ed311e3c42b975a75d23a0056210e2ad3e
d30f415758c3cab377c63b3dd5a043d83d153c47a8f6aae56e88c5868d090556
c80a78a69b180edbd9c52c5828d7adabfba05645618ed23d9728d1ea8ab394b1
bf6a195481cb4cba11f09c03c4fca9be90f011fc883dad09b8b79a4b94e3aafc
fe8988a0ee2b5c321d3538ed71519c3f3a73746a4a1adc9c84b3ce574fd353c3
21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6
5532787ca87e4586e69a4b8ef22e23faefcd66a1bef5864d1cbf8e6c4df1989c
22dcbd98f140f60b488ee8413a8a16b7d1d99b22ded2e82f5aad36cf454384a2
c4261e2c68f2fed74c9fc7d89f64ca53ed9bcaca51e870f8d760167b8e2e6186
3dca60e7a32bc81165f399bab2162271332156e05c490ed4af3972713a1cb0f4
e28bce0b6ccf49e32050baa8539c9b91cbbbd9dbd8382be57f6e8c44bab74956
7d32b52e3465e4c07cc727fa95fd264c07091fc0adf65ea0ed01ec0245836bf5
6f505344ed0b63ea1ca3b058da81bd53069385a4fec5b94f7e97ecd3e53bf57f
ece8d55b66fdd470a1037290b30a2e6e66d0ff38fa366ec37a2b0a330364093e
ee4ff10990ca92dca3a0ee6feeff6930f5dbeb239e747cf69ab4560a65a9fd0e
7d0fdf3abd56e00933c0fa8cf573b948a4c9d85248915249f1909e6775f75e75
6982ab1d029213bfcfbc542eee0d955b770f5c0df083dc94463c441e2de35fe5
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557
cfe9062e6bd88ae993c3e8b295386c2e5e9aa7d8b9ceb168f56ccd3e0e5cbe36
f6bb03b4bffe8e0ab71cd8e26a65b3baa5f870cee4e974851dce6d8140316c84
00b678e92dbc23f5d49fa664274e0896bc194d32957ce953340f078b7f740df5
a9c993b79501ed32742c5ccfd04e3c47d75fd26795fd87bb3dfc288384de7be3
ecfa6953a0d70eac807833f74a201fc694a325cfa964303e82348abf082dfaa5
d549aca33462425f1f32e75b6635986df724a63b6f738247d4be19de580bc899
2484f3b9e112f39471b0375d98ac190b4ffe3e29a295bcecdb8fd7b71af0094b
3fe2c04c33423019af7464d50b3df0775a565e9a31e1a289b49e4e180585ab00
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
a1fc12e0b11dc727c1e4f58da908d512b2ea1fb69cc317e024390440807d62eb
68688eb3a301e7b383bf631b7dc95dbeedf6f1fe23d7e3a6b8e0e45fccf6b8e6
2f63ebbdab728b4add526836bbe063788228b48240179035db13f85b9836559d
b9bdf17b0783f5b073ba007091604c0407e825b17ae8ae90bf53d2a2140341ba
4b400ae71cf7cf4f1125e27b683861b698fa6ade4f8fdeba92c0ac819b72bcb6
5a056284d1d1ed301db9889707086b4f90527b0e22965fc3a01cc1abd97a2972
362365797a625ef308f4071bc408a35c5cf5db4c2e6847bb854b995eec8e658b
7af072164e5fc3c39c58fe100e422e079c2b98ab185065962569ac8b12c7517c
9296272090597bd4d2723682f9ab6923356efad185125ad318eb778637b36cff
74ed6e04325307fef674714dbd65803fe7a4d5d784522c7b65cf5f9953b2042c
a28cb539852da2e100484ab8cee9613a28b2e68d409b99d80e27f4fb7f238b5d
6a904048b9d948e087012a190d07d2acf4ed6b1ae0d666d4f6da310d1863a1c4
0368b2ffa6991460a59b03edcd2ef71c423a27d4902b2222248bc0935776614d
3017b026d0925919ad8085d523f83235fa84ead58d1399576e60e6183003820e
7cdbc9e74ca8d6119202864a709809712505bac9f32b6d60c552f01a1ac090c3
6d8cd5b437db834821da59ec82032cb88c459cb614382e4125c208f42c35a7bd
02b060c393fbc76a082ef0411f28e2be60bce1af80ea2df91f003e9b8a762b88
64e9e76c9c64aa89f98ba7a6413df1c33fd3e5efeb35a7d52cb9b8b4fbe6f443
93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200
1cc318613830f916bdbd91c8bba57d82473262361b46abfb9c41bc4bae0687ff
SH256 hash:
727f9b6035d60136df752ca563b81b450edba65318950576f9297012065ad353
MD5 hash:
21ca0219145c3865292d6311bb2e337b
SHA1 hash:
cb73ea6195dda48306ecfcd8170eecab49ab3bb5
Link:
https://www.unpac.me/results/9819e228-5a12-4c2b-9db3-e349f4fd6128/
SH256 hash:
4c7ce432433fc3a8b0a33d558e0041d3f1c222224c5e61f33104d990a534c7a4
MD5 hash:
e8d756b4e2de5a67446e0b1b80e1bb99
SHA1 hash:
b664448f87ac044a16706d35e5d76538ba79508a
Link:
https://www.unpac.me/results/9819e228-5a12-4c2b-9db3-e349f4fd6128/
SH256 hash:
14d2bdde0de4d7bc55155e39908a63dfc4f2da5acf7864811cb9a022d93959f5
MD5 hash:
ab805d07a83eb0387fb23757052d1a30
SHA1 hash:
b5035220ec1c7cd17deb0e4974a7d3035ec58b15
Link:
https://www.unpac.me/results/9819e228-5a12-4c2b-9db3-e349f4fd6128/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/9819e228-5a12-4c2b-9db3-e349f4fd6128/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200
MD5 hash:
bfcc7c29b09747aaf19d959f3a2840ee
SHA1 hash:
0e8ba089874b1712f080c762e98b9cb6e3a4b1dd
Link:
https://www.unpac.me/results/9819e228-5a12-4c2b-9db3-e349f4fd6128/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/93a9ea827dd8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 4f6cc56f67e35b039a881c9994bd4ef7f99690d338f4603bd8c8d0534c5114f4

Formbook

Executable exe 93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4f6cc56f67e35b039a881c9994bd4ef7f99690d338f4603bd8c8d0534c5114f4
  
Dropped by
MD5 24063af7bfa0ca0fcfaa0dc2e6e3edde

Comments