MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b407e91e4e3f005698d688198db32e9ebce62920639d4af69ffed72921310e78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b407e91e4e3f005698d688198db32e9ebce62920639d4af69ffed72921310e78
SHA3-384 hash: c39268a77f52f28c34f8ab14fe2a6565dbeee4f538c15eff8d584e00f3392882a126bc6bba9abadc91dc2695be1f11b4
SHA1 hash: 57362ebb3d493bbfa4e7e7b2ae69dd904ca4598f
MD5 hash: da2f70a37f97006fd30c7d2f2460ce6d
humanhash: india-fruit-bakerloo-wolfram
File name:ZHoHhqbY8eyX4fZ.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:607'744 bytes
First seen:2023-07-10 09:38:08 UTC
Last seen:2023-07-10 10:09:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:+Xhg5KMG6UFCGLgDL6RnqIIm/7Pi9z73KLhDY0lk:+KoLFdg2h7657aCZ
Threatray 3'327 similar samples on MalwareBazaar
TLSH T16ED4022362A5D729E85C0FFD1141A44A23D9AA459C39DB2CDC2F8CD6DB36B34019CBDB
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
292
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ZHoHhqbY8eyX4fZ.exe
Verdict:
No threats detected
Analysis date:
2023-07-10 11:01:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8438eea7-9c2d-4dd3-b937-1c397a67aa5c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/413479/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2163.8215.3214.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Restart of the analyzed sample
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/64abd1b89bd9f933fbb93a8e/reports/2b0b0e2c-08f1-486e-9fbc-c1ffcd3dc331/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/b407e91e4e3f005698d688198db32e9ebce62920639d4af69ffed72921310e78
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/97636901-0c92-4fcd-b31f-6055238fb8ff
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1269579
Signature
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1269579 Sample: ZHoHhqbY8eyX4fZ.exe Startdate: 10/07/2023 Architecture: WINDOWS Score: 56 16 Multi AV Scanner detection for submitted file 2->16 18 Machine Learning detection for sample 2->18 6 ZHoHhqbY8eyX4fZ.exe 3 2->6         started        process3 file4 14 C:\Users\user\...\ZHoHhqbY8eyX4fZ.exe.log, ASCII 6->14 dropped 20 Injects a PE file into a foreign processes 6->20 10 ZHoHhqbY8eyX4fZ.exe 6->10         started        12 ZHoHhqbY8eyX4fZ.exe 6->12         started        signatures5 process6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b407e91e4e3f005698d688198db32e9ebce62920639d4af69ffed72921310e78/
Threat name:
ByteCode-MSIL.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2023-07-10 09:39:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wqd6shsoh4afnggwramy3mzot26omkjamoouv5u773lssijrbz4a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
00d56f9d4e23372133f953d1a0bb58567bc2e9bc34f9e70304116a6382448458
Formbook
086958fa9ccd6fd426c1c627eca3412870b41f0eef471663bf8ea5f0c19c5c8a
Formbook
14ac214aee66557d77577da7211f5fa6476753b38ff8b40738c660a88c8ffd35
Formbook
2d9e23f8ac381af2847ddde8454f1cc042b6beaa60e484d01efe7f37effd21c3
Formbook
68ba26474bb29bdbc42cfddd75f212eec1ffa22d5c1affc893addce5330f4e11
Formbook
6ef2063e8207f9c58067966a90ec7bfbcc6c31b3df611fcb8bf88cf531e579d0
Formbook
713295015c5460b487bd9e9fbe4ac0e600791a47911852e5a5feec1bafbb55fe
Formbook
87f7348a8731af0346cfcc709488d0831a95236f554d2f8a50e12eea1ceb6764
Formbook
bda1a08d1c632950d8a4980f501b78336a1f0602919365d40c62b3d2877041b4
Formbook
e4268cb757dab357988c8891f77ac727af8c27acb4668d9361237a5df26e9b69
Formbook
+ 3'317 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230710-lmmxpaae8w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
5a0949eef9c6048fb1a7d2d12baeba04e9b725ded4bdd25b518db1b36a4d771f
MD5 hash:
fdf9204c13bec32576ada39969d4231c
SHA1 hash:
d42cec300723e1fcd33dcd194214f323cb847c2a
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
0756e6d822bab0f86c1ed1c7b81c8c1f842429a123239edb74ac3cdfad86bbf1
MD5 hash:
cf550fcac2bcf9f999271a4cd203ef92
SHA1 hash:
13d5305cf50e2cc3d9ae422ade334677525e6723
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
e69bf66cdcdeda6a259482628c417b017c74be8b4560df0b644a252cb2488f2f
MD5 hash:
c36c67396812965879619d1641ee9230
SHA1 hash:
0aeca65829e9ffaf34b0eb2246e0a245ae3d6981
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
5a0949eef9c6048fb1a7d2d12baeba04e9b725ded4bdd25b518db1b36a4d771f
MD5 hash:
fdf9204c13bec32576ada39969d4231c
SHA1 hash:
d42cec300723e1fcd33dcd194214f323cb847c2a
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
0756e6d822bab0f86c1ed1c7b81c8c1f842429a123239edb74ac3cdfad86bbf1
MD5 hash:
cf550fcac2bcf9f999271a4cd203ef92
SHA1 hash:
13d5305cf50e2cc3d9ae422ade334677525e6723
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
e69bf66cdcdeda6a259482628c417b017c74be8b4560df0b644a252cb2488f2f
MD5 hash:
c36c67396812965879619d1641ee9230
SHA1 hash:
0aeca65829e9ffaf34b0eb2246e0a245ae3d6981
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
5a0949eef9c6048fb1a7d2d12baeba04e9b725ded4bdd25b518db1b36a4d771f
MD5 hash:
fdf9204c13bec32576ada39969d4231c
SHA1 hash:
d42cec300723e1fcd33dcd194214f323cb847c2a
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
0756e6d822bab0f86c1ed1c7b81c8c1f842429a123239edb74ac3cdfad86bbf1
MD5 hash:
cf550fcac2bcf9f999271a4cd203ef92
SHA1 hash:
13d5305cf50e2cc3d9ae422ade334677525e6723
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
e69bf66cdcdeda6a259482628c417b017c74be8b4560df0b644a252cb2488f2f
MD5 hash:
c36c67396812965879619d1641ee9230
SHA1 hash:
0aeca65829e9ffaf34b0eb2246e0a245ae3d6981
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
5a0949eef9c6048fb1a7d2d12baeba04e9b725ded4bdd25b518db1b36a4d771f
MD5 hash:
fdf9204c13bec32576ada39969d4231c
SHA1 hash:
d42cec300723e1fcd33dcd194214f323cb847c2a
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
0756e6d822bab0f86c1ed1c7b81c8c1f842429a123239edb74ac3cdfad86bbf1
MD5 hash:
cf550fcac2bcf9f999271a4cd203ef92
SHA1 hash:
13d5305cf50e2cc3d9ae422ade334677525e6723
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
e69bf66cdcdeda6a259482628c417b017c74be8b4560df0b644a252cb2488f2f
MD5 hash:
c36c67396812965879619d1641ee9230
SHA1 hash:
0aeca65829e9ffaf34b0eb2246e0a245ae3d6981
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
5a0949eef9c6048fb1a7d2d12baeba04e9b725ded4bdd25b518db1b36a4d771f
MD5 hash:
fdf9204c13bec32576ada39969d4231c
SHA1 hash:
d42cec300723e1fcd33dcd194214f323cb847c2a
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
0756e6d822bab0f86c1ed1c7b81c8c1f842429a123239edb74ac3cdfad86bbf1
MD5 hash:
cf550fcac2bcf9f999271a4cd203ef92
SHA1 hash:
13d5305cf50e2cc3d9ae422ade334677525e6723
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
e69bf66cdcdeda6a259482628c417b017c74be8b4560df0b644a252cb2488f2f
MD5 hash:
c36c67396812965879619d1641ee9230
SHA1 hash:
0aeca65829e9ffaf34b0eb2246e0a245ae3d6981
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
SH256 hash:
b407e91e4e3f005698d688198db32e9ebce62920639d4af69ffed72921310e78
MD5 hash:
da2f70a37f97006fd30c7d2f2460ce6d
SHA1 hash:
57362ebb3d493bbfa4e7e7b2ae69dd904ca4598f
Link:
https://www.unpac.me/results/11a6bf21-96d4-4956-a92c-0655e9d5c332/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b407e91e4e3f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe b407e91e4e3f005698d688198db32e9ebce62920639d4af69ffed72921310e78

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/413479/

Comments