MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b01e5b6141f0e4c548007910ef1a52d01aa5402e8cc8751b8ad7571a9ee76d00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b01e5b6141f0e4c548007910ef1a52d01aa5402e8cc8751b8ad7571a9ee76d00
SHA3-384 hash: 6e23f1f3b2aa115c0405245df2b0879d1840407af02fe2bd5511da8774b1eeadb4b9ec482f1efc1a1a277d5b7d989df5
SHA1 hash: 3d0b7156a35f757919fec84629ebe98fc1eec088
MD5 hash: ba5b6824b167bbaff08e7ac71a793ade
humanhash: alpha-green-xray-alpha
File name:INQUIRY SHEET.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:738'816 bytes
First seen:2021-08-03 12:39:07 UTC
Last seen:2021-08-03 15:52:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:g1Otfgz4u3EGLBBBBBBBBBBBXBBBBBBBBBBBiaNVrenVcw79HEFQ02bxhcxgQtaA:+xzoafcmWk202bxhc5ecHDBKu
Threatray 14 similar samples on MalwareBazaar
TLSH T11FF4AE223AFA515CF3B79BF60FC4B8AE4AFAF5B3A509F0B53852074543219818D52772
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INQUIRY SHEET.exe
Verdict:
Malicious activity
Analysis date:
2021-08-03 12:40:22 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/cef3d2db-63a3-4a02-a256-469e4a886bdc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176043/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.964.12710.11372.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/84d37983-da8b-480e-b1be-60b73cb4179b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/826135
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 458558 Sample: INQUIRY SHEET.exe Startdate: 03/08/2021 Architecture: WINDOWS Score: 92 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 5 other signatures 2->25 6 INQUIRY SHEET.exe 3 2->6         started        process3 file4 17 C:\Users\user\...\INQUIRY SHEET.exe.log, ASCII 6->17 dropped 9 INQUIRY SHEET.exe 6->9         started        11 INQUIRY SHEET.exe 6->11         started        13 INQUIRY SHEET.exe 6->13         started        15 2 other processes 6->15 process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b01e5b6141f0e4c548007910ef1a52d01aa5402e8cc8751b8ad7571a9ee76d00/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 02:08:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wapfwykb6dsmksaapeio6gss2ankkqbortehkg4k25lrvhxhnuaa._file
Verdict:
unknown
Similar samples:
0f330652345ef8518b898bf3f58e2fc1145e5cb4f4801bdeb77f6bc802b8e99d
Formbook
338aa2c1775d9e5d546abd328fdf31f20638905e85e684c7470ed5de507775ab
Formbook
56e9e3ac63d727a6ba0d0ff82236083ac8aa806bd70373fb9c5e8ddaa87b8ee3
Formbook
7ad6ca0be762e10394e0854478b16e2488117b63b772d69ad6cd699f9e2a092e
Formbook
94dc3ceb75323f7b1bff7355da2d28804d4df36fa98a1335211101ef94bb2dda
Formbook
988ec5d9bc02691882a3180947ee76fabc3629413f79a2e4768b9adb58ba432c
Formbook
d4db69bade281fb989590744f1bf16e23c686dd5c878fed34b1180ab11d30b0e
Formbook
e1cfd08ac642d3a0ea5b37efee371f39889edf4a147ef0b63d643d6f25767c9e
Formbook
e3c270600328928f0c6576743fd759ca88b86abb024ae180549c3a5be0e7e41e
Formbook
ec020ddc20a07b93afa94a9a3b95b8244bd9a8c8527742cd35957e4c91ca4604
Formbook
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210803-qbbvp1l1zn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
5b968378eba418b941868c054f6cbbff36243071fe1f9b8ecd93ac4c007d39bf
MD5 hash:
edf0022d128145c693ee9df21e66198e
SHA1 hash:
10807c044936d4c0b5f42ddfaf10f53f899745cd
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/fb27c3f9-8a05-4163-b70c-5a213e4ea7f0/
Parent samples :
c1ac4c50a78b858365062dc71a9fe5f3a3bdf39b4d8902b1f8311f2c2a86064b
89fd73d17d825a1e661f69b41ffd9fcd9f5a3d044159763cbc82ffd0210eb78a
6f42be9adbf8a5232ff93cbbd74b5616319ed32863c9b5cc9f6fb9383d618151
6e2f5b008bdbf0b7c7c81649b7097bba3b1a6937b59c6e8eb20f1882707cfbbc
b01e5b6141f0e4c548007910ef1a52d01aa5402e8cc8751b8ad7571a9ee76d00
317613289fb0cce8c301f63922883b30d54bbcdf1cb01bfa772244e03a07dfda
1e46ccc09a1bbcf427da5d02951660cf45cdf9b809884988157d680888bf8796
6137b2968c98b110deef11d69b037a5d541b39b930628d12881b6daa5bdb9bb4
29f3a920994225a5424f5e1710a9980710e4330f85aeade18182b5fbd5f2a354
1b4d3e69b4e2e533522d48f27a0137e34b92b01e36d348c12f0df4371ed7d573
83e85200231274906ae296a4f8842215e73cbba4c5cf8b59a7f83e5f2fd49887
bf676c0c2a4db1ca2df33c677b9fa836fb7bbd13d5021fcdf5bfeb2167674661
af5c86dda09842ee8b442cea3c224c8e0cea387406a55f1dac5abb32d6aa1b8a
05a53e2be383e030568c52470368baef5ea6da1bf6a27bbc6921173457c10bf7
SH256 hash:
e0a2f077dcacf88ce7e39180e2737b66612a2322630dcd20fad8ebb1b4c7d094
MD5 hash:
ad9ca35b5803bb4e86a2379496efd1f5
SHA1 hash:
2cc07404009d0f1be9d16db8b4b49a07d7b10c18
Link:
https://www.unpac.me/results/fb27c3f9-8a05-4163-b70c-5a213e4ea7f0/
SH256 hash:
cfef97ff706312dff4edd998aeee22f1283221631ebb0cc954bebbb701c1465c
MD5 hash:
a0f625a3d3348903f3c902f588c0e4f5
SHA1 hash:
20d1f0b74abe6f500e8c21119f55281926210ac0
Link:
https://www.unpac.me/results/fb27c3f9-8a05-4163-b70c-5a213e4ea7f0/
SH256 hash:
b01e5b6141f0e4c548007910ef1a52d01aa5402e8cc8751b8ad7571a9ee76d00
MD5 hash:
ba5b6824b167bbaff08e7ac71a793ade
SHA1 hash:
3d0b7156a35f757919fec84629ebe98fc1eec088
Link:
https://www.unpac.me/results/fb27c3f9-8a05-4163-b70c-5a213e4ea7f0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/b01e5b6141f0e4c548007910ef1a52d01aa5402e8cc8751b8ad7571a9ee76d00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe b01e5b6141f0e4c548007910ef1a52d01aa5402e8cc8751b8ad7571a9ee76d00

(this sample)

  
Dropped by
null
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/176043/

Comments