MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8149ed051ce39e0fd94eb4f6af6934cc9e5860242aec44c3ea3a36454af69df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8149ed051ce39e0fd94eb4f6af6934cc9e5860242aec44c3ea3a36454af69df
SHA3-384 hash: 72de0d7e2a2bfe06d8d16e5f2aac0087036248fb6f51b88312879d4dec65966d6ad9f4e026c928169a9541f57ea85a09
SHA1 hash: 41eee5ac71d6c03fc58ba38bc1a47ae6557086f4
MD5 hash: 88b0c932e404501921d7e88757bf82b2
humanhash: purple-missouri-social-blossom
File name:zackzx.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:671'744 bytes
First seen:2023-11-29 14:24:39 UTC
Last seen:2023-11-29 16:28:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:eHS21pfU3JaSOyI4/V4ERlG1pv1cUme+NhLuMvz/f1goq2BuqQopox:O/c3RISOBv15u31Q2JQe
TLSH T1D3E41201A6B86F2AF5365BFE1865265047B1617F7230F3A95EC231DA1BB1F800B91F27
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
297
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO.doc
Verdict:
Malicious activity
Analysis date:
2023-11-29 11:55:16 UTC
Tags:
exploit cve-2017-11882 loader
Link:
https://app.any.run/tasks/b5c32542-e45c-44bc-bd90-92f92c15ce3d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/461205/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.22749.27797.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Launching a process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a8149ed051ce39e0fd94eb4f6af6934cc9e5860242aec44c3ea3a36454af69df
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1fbd70d4-c156-4ee8-bfa6-08a98b64cbee
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1349916
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a8149ed051ce39e0fd94eb4f6af6934cc9e5860242aec44c3ea3a36454af69df
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8149ed051ce39e0fd94eb4f6af6934cc9e5860242aec44c3ea3a36454af69df/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-11-29 14:23:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vakj5ucrzy46b7mu5nhwv5utjte6lbqcikxmitb6uorwivfpnhpq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231129-rrae2sgh43/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
c55add5a98de4bd92f0af3f0a4ccaef0a7e01eb1d5f1dbffe2eb055426c14880
MD5 hash:
953a32d0a4e421794f93ed2e5369e09c
SHA1 hash:
f383b33f0ed319a885b6102500b3415f86452bdf
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
602534b072eb0a28f1c44c9676f84ced1fd9af0c870c76ab990ab4333e95eb04
MD5 hash:
1ba2aba72c799c4a1f327a024ab0d484
SHA1 hash:
0fcd94ad9b1d0f1343d35bbc9d1dfe228d508038
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
797e57bd74a68f7b4808a213f5c319ee4f4b023bc73088175d4393dfee9fe329
MD5 hash:
3c927935fbd608e7628cc2c5ad7d52fd
SHA1 hash:
ee0c880c0614ac960fd641f7d479233584aed1d8
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
e88a0ecd8a546b81993a01d5b181a76b677fd22489b221456dbce358202947e1
MD5 hash:
384cfbef6fbbdbead98fc4cca80b3366
SHA1 hash:
850cb66538638faaf0b02be400c68e6de7ec873c
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
2d81218360279da87741d6b9fd0e0a09de3d3fde2240360584bface30b61c278
MD5 hash:
6dbf3e020fc996f68f87ddde7ab0ef3b
SHA1 hash:
5292940180567546ed17fde614914a2de7018126
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
3b318c593c9cb715d3f19f0537435bc4024069565feeeb27fd1f0f8215942a82
MD5 hash:
186cd346baa5d54032cb522b29358977
SHA1 hash:
99848439dd08efed5bc6ae5e5fb3d84218011fb1
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
cabe104ee329cea058e016b69b807bdbe2a375ab9462b4964d276f8b0149cd1b
MD5 hash:
a08f273db9480c74f4db16c0c229219b
SHA1 hash:
8c6f460271a520c8cf89e87ccd23c487c41053a8
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
4cd89efb84ff5f338eee89004512d1d2daf7ad4412b43338ae5b1dc3221bfff2
MD5 hash:
7b6d11f96ab6410f33983b06d9268e00
SHA1 hash:
656136722d66e5164b04671f7bc379ba1d0c8575
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
414be09a6e4e32b8fdfd6a4a9d7ecf3b32648ab1ded1d0a4cd3a9b2d1e6c99ed
MD5 hash:
7fde1eaa9e52d7def9a9aab19f9738f2
SHA1 hash:
630c8ed27724e313f1e361ff783f7f1252002e72
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
d7b01853fbde29c03745ddd81a161ac87d469b58bf2be3c4a14bdd1b0b08133a
MD5 hash:
981dd82aeda826caf352d1972acf7398
SHA1 hash:
4601bfea048bbddd6870ed172fd80ad70a79aa1d
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
5b1d72074746b1cb57a662c3bf70bc4d4ee1a9fe1100dd15d0c3d98835a3adc2
MD5 hash:
257fff2e64a42c6655a121f8275f584c
SHA1 hash:
1184ba4fe43f18338227ff3162f1093dab26857f
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
SH256 hash:
a8149ed051ce39e0fd94eb4f6af6934cc9e5860242aec44c3ea3a36454af69df
MD5 hash:
88b0c932e404501921d7e88757bf82b2
SHA1 hash:
41eee5ac71d6c03fc58ba38bc1a47ae6557086f4
Link:
https://www.unpac.me/results/5345c828-a52e-4324-8fda-f3822fff4914/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a8149ed051ce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a8149ed051ce39e0fd94eb4f6af6934cc9e5860242aec44c3ea3a36454af69df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/461205/
  
URLhaus
https://urlhaus.abuse.ch/url/2736248/

Comments