MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136
SHA3-384 hash: c09013b239c22c519790ca72eeaf2aee6cbda5d34bb5760f5dab3d975f201ed57ca8c998553040f7b5f15e2bf453db6b
SHA1 hash: 7d9aa14cc65fd29796990aa6575713592e1414c5
MD5 hash: a5c0824c656260518c8bdda3bcc79e22
humanhash: solar-stairway-venus-spaghetti
File name:FedEx_AWB#804230516763.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:643'072 bytes
First seen:2023-11-08 08:11:47 UTC
Last seen:2023-11-08 09:20:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:kYoORkSI/VnrQmmK8/9rDFaStS31kvMrAnV7/bSny/ApFvp9UqojzUqULh+sk/No:vo8RI/5rQmmb/B4b1kvrV7/bYy/m/KLi
Threatray 64 similar samples on MalwareBazaar
TLSH T136D4239DE1888EB2D8FE0BF464276658037522170C42F78DCDCEA1E5263BF990B546E7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon d4060733230706d4 (9 x AgentTesla, 2 x Loki, 2 x Formbook)
Reporter abuse_ch
Tags:exe FedEx FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
302
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.59820.21714.6203.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/654b42e83dd412119bf161b0/reports/18a2b71a-0a2a-4881-bbee-959cb8237071/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cfd77edb-6a41-4bab-b0e5-ef62b25f920a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1338855
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses nslookup.exe to query domains
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1338855 Sample: FedEx_AWB#804230516763.exe Startdate: 08/11/2023 Architecture: WINDOWS Score: 100 29 www.myeuropesmartmove.com 2->29 31 www.lifeiextension.com 2->31 33 15 other IPs or domains 2->33 43 Multi AV Scanner detection for domain / URL 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus detection for URL or domain 2->47 49 6 other signatures 2->49 10 FedEx_AWB#804230516763.exe 3 2->10         started        signatures3 process4 signatures5 59 Injects a PE file into a foreign processes 10->59 13 FedEx_AWB#804230516763.exe 10->13         started        16 FedEx_AWB#804230516763.exe 10->16         started        process6 signatures7 61 Maps a DLL or memory area into another process 13->61 18 HLyTbSnnVNElpSmXRCoEzHi.exe 13->18 injected process8 signatures9 41 Uses nslookup.exe to query domains 18->41 21 nslookup.exe 13 18->21         started        process10 signatures11 51 Tries to steal Mail credentials (via file / registry access) 21->51 53 Tries to harvest and steal browser information (history, passwords, etc) 21->53 55 Writes to foreign memory regions 21->55 57 3 other signatures 21->57 24 HLyTbSnnVNElpSmXRCoEzHi.exe 21->24 injected 27 firefox.exe 21->27         started        process12 dnsIp13 35 www.ceravolt.life 203.161.53.83, 49732, 49733, 49734 VNPT-AS-VNVNPTCorpVN Malaysia 24->35 37 www.purelyunorthodox.com 154.204.19.73, 49718, 80 SKHT-ASShenzhenKatherineHengTechnologyInformationCo Seychelles 24->37 39 6 other IPs or domains 24->39
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-11-07 06:32:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tclas4hqcopmijhh7srzi2vkdph27bjzs3i65hvxfftpoufice3a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
5fdda4d6b9e259f64f6c95a8e623993315b0f3226a6f9be0124fb432e49ede65
Formbook
82e2999475b441f03d417b5ee9df2615ec04693e11c15fd5f6c1e444293b85e9
Formbook
8866ba769a0a6f22f134b6a855b7e20ecde5df86572606c21b4d1df139169c26
Formbook
dd6b0535110695ea9fe92bf6eac3e2b98c72b7bd9edbe3ae2ca6a1e4ac348c22
Formbook
e8a820b07074384be7c1ffd4f07a230ebce48a21f24a67ed1c0572a6570b2410
Formbook
+ 54 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231108-j3vlcshf73/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
c8f9c3385d64a970f7df88314135683a49498349305832bbe82e34d38d2d7324
MD5 hash:
46d9ee8f5276edf2717401b6a50970cb
SHA1 hash:
39c80b49ef97189e8931797f06e3179667fd88c6
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
Parent samples :
3f98f70b03b079fcf00f40d8819a849513f391eca65c7a3424687138924c60a9
1cc327be5ca8d7bd4cd244e9cd90454611559df4e971c3bd6649682413582c1e
b907644a3bb4a1b9c09a952057ab8c9bcc7111e2e918115cdff09735181ea6a3
98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136
c17b3e778d12a1b353c665515c1de44df04d6172f0448b62c9cf6dd9e44bb6ca
220d35d385349e3abbaece7585c05e1caa1a7bf9117aafae75c72b94e116ceab
SH256 hash:
d05893b7f6f8e80de00ec14432669d61fcc0e3e84d1a8235e6c9207a2fecc650
MD5 hash:
5fbe5d27b6cbcb98066b83b977bcf634
SHA1 hash:
bfe5828699cc8d7b30f878dfbc3c3d803b9ef138
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5
MD5 hash:
579197d4f760148a9482d1ebde113259
SHA1 hash:
cf6924eb360c7e5a117323bebcb6ee02d2aec86d
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
de3cc23db3d1714365d18d81a17ac44267656686ce044eb9f806a8333d9981e9
MD5 hash:
a7bd43ea677b3039004b47c60317679d
SHA1 hash:
9756b88646bcb9e7f9b9dd47e632ea6a5a519265
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
bfef9eac82e53e8d63bcb3b3022880eaf8f22cbbc6c69f3782b59c438f649f12
MD5 hash:
ddf81912128dd196140e9be656c3a212
SHA1 hash:
51221baf7115f7f2de03cd00b8b25cfde9241a35
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
95df2e1296b09b1657da370bd293774faf0caace6c27efcfa6f332ac07a1b4b1
MD5 hash:
49fbe58b8a33a40d320394b6722b97e6
SHA1 hash:
9fc728f9c6e80383e0f8a721b09931180325efa1
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
bbc85cd3947b58d94748f68f7512364b1ae607ce72d1f310aff9943566637cd9
MD5 hash:
49ad7c686f2ad74e2bd2bd530705cb26
SHA1 hash:
9c20d86a0422fc9c3ae6a1e42967776ffb218d37
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
afd5d8f1d5610fc7187d1dae75be2f18d06cf882ce9e82c20797917bc6118eea
MD5 hash:
e22ed8419a82f9d4de0d2f89555cec7f
SHA1 hash:
8f3ac7cbe04747334e8817ff7bdbba3ace7644af
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
2ad9367ff90c1a0d16a52226c8878b8c121f7bbcabe18868d4c097451c3bc69f
MD5 hash:
235647ef7a15e9f15d16d161d8deb855
SHA1 hash:
8412ca25eb3cef07f8b769e27b3baa8721ddff23
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
c25bafe4c3b94c1d03b88926a6c2507d5905d72d9fde0c0ebf153f7b20abc66e
MD5 hash:
4971f1aef11c1f6bebb6238e36e2efe1
SHA1 hash:
378b25683dd109d07698a978c640d4fb939dd275
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
a57c3f080930b8c7e171c57044bc23a26ce2387689c90f26d4d5c7cb7e08a0ed
MD5 hash:
404bd9611baef0b381c0b1e1a4a5a595
SHA1 hash:
367f69e74b9394c2fdaddb37e28ad3e217958b04
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
SH256 hash:
98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136
MD5 hash:
a5c0824c656260518c8bdda3bcc79e22
SHA1 hash:
7d9aa14cc65fd29796990aa6575713592e1414c5
Link:
https://www.unpac.me/results/7e5917c6-07df-4656-9a1c-f7c7fab5815f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 98960970f0139ec424e7fca3946aaa1bcfaf853996d1ee9eb72966f750a81136

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments