MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0
SHA3-384 hash: 8839a7ba7af11b646e83e1b464407496a54a5fcf7471acc9699d3edaa50cf1e0278531bbe7484e79df3fea3708fb2750
SHA1 hash: 336e16f5566dcb853d9fdbefd6a7db4a3158db5e
MD5 hash: fa30f2c3ae46b04496cdcea1d74e1971
humanhash: cardinal-happy-autumn-hot
File name:Fatura.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:711'680 bytes
First seen:2023-08-07 07:53:04 UTC
Last seen:2023-08-07 09:04:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:fQ4fTNZ2D2NUbb96H7b4mNw6jTvWZ6QvoWcm5gcr4Z:oWTvh/H34mNw6jTWZ6VFWrs
Threatray 275 similar samples on MalwareBazaar
TLSH T1D9E4E10572A99F97D07A83F90961A52017F46CAF1179E36DAEC2B0CE1A32F104E55F3B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 32f1cca6d530f058 (7 x SnakeKeylogger, 5 x PureCrypter, 2 x Formbook)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
258
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Fatura.exe
Verdict:
Malicious activity
Analysis date:
2023-08-07 08:01:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c899058a-c813-4107-a495-bac90f449cfc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/440988/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2222.334.30394.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Restart of the analyzed sample
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Creating a process with a hidden window
Launching a process
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/fa9a805e-a0d0-4a51-acda-8b9b89b5b74c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1286915
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1286915 Sample: Fatura.exe Startdate: 07/08/2023 Architecture: WINDOWS Score: 100 37 Malicious sample detected (through community Yara rule) 2->37 39 Sigma detected: Scheduled temp file as task from temp location 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 3 other signatures 2->43 7 Fatura.exe 6 2->7         started        11 dVRJDCgHWv.exe 5 2->11         started        process3 file4 33 C:\Users\user\AppData\...\dVRJDCgHWv.exe, PE32 7->33 dropped 35 C:\Users\user\AppData\Local\...\tmpC326.tmp, XML 7->35 dropped 45 Uses schtasks.exe or at.exe to add and modify task schedules 7->45 47 Adds a directory exclusion to Windows Defender 7->47 49 Injects a PE file into a foreign processes 7->49 13 powershell.exe 21 7->13         started        15 powershell.exe 21 7->15         started        17 schtasks.exe 1 7->17         started        19 Fatura.exe 7->19         started        51 Multi AV Scanner detection for dropped file 11->51 53 Machine Learning detection for dropped file 11->53 21 schtasks.exe 1 11->21         started        23 dVRJDCgHWv.exe 11->23         started        signatures5 process6 process7 25 conhost.exe 13->25         started        27 conhost.exe 15->27         started        29 conhost.exe 17->29         started        31 conhost.exe 21->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-08-01 04:42:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
35
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ylgipsr4ltoolad4okpyb2ex3vawhcibmjy4llio6b2pwsnclqa._file
Verdict:
malicious
Similar samples:
1fe0659929bf6a67424138eddac1876c3fcc771e614bf90b286ecfe083641bdf
Formbook
2c9e58b98c0929168074d7742170d85eb83c23f97aff8786381aec250af1d6f8
Formbook
4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173
Formbook
77f42c84ab266e5cb7c3ac457e324874c7b6e3b1f64191ada33bcab82f33a57d
Formbook
ac0ec8320601c7a274a4a97536cc6f3387964581b1a676d0c276381437967ca0
Formbook
b9008341c54406621f94780f0d01e2cf61946a48101738fa73531687a5f1caad
Formbook
be34a7f3fb6fd3a52d2c2fa5452b6cf7fb4afa00ca29bda99c0e4710771ef71c
Formbook
eeebde8089d33c9b76eddd2a7c2bf80eac9d56716b45662398385d21ae5853c4
Formbook
+ 265 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230807-jrjpqaec56/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
8c2ca57a8a7420ea209eff1e6bfb7d96584493e0b23865b5438d473baae24239
MD5 hash:
ab622cf39eabb58381aecbda245d8233
SHA1 hash:
a154e6ca9e5ef486b4ea5d3794986316af5207e5
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/6330d6c2-f38c-4478-9228-5b0bbc4f6f5b/
Parent samples :
20fa6136a8a585a8f30110a5dd5fa9d8b2f9a2ee0eff590a721656eb44eceea0
2beabdd285adf915fc07418c5f9e57cc4430f766b838e1726570c21af4868f18
c06a41f8cc26ea5c1258decc9ac07f2014b29266b4a3a7c0d7183dbc706ffeed
4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173
de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0
bd34a0f8b26f8e2715969b34a236ef365637ef80baff9d9781348e631b3406ec
SH256 hash:
b5084dddef652fcad599c2e52e71b8caf2420ecde2ce5c903848e21b0a531493
MD5 hash:
7e2f175c59b3ec03712cdf56c71ac58e
SHA1 hash:
45e8da5f9007525f31ff523761ae4502488a29ab
Link:
https://www.unpac.me/results/6330d6c2-f38c-4478-9228-5b0bbc4f6f5b/
SH256 hash:
800683e8e3ed30936e56987d6a5fd3c434ce48d612911c22c156716ad573c088
MD5 hash:
9d1686a5b6fe5ca73d7977d2766c7f5e
SHA1 hash:
cf0229d75f71a7124cf2dc943f40c0f70cc90774
Link:
https://www.unpac.me/results/6330d6c2-f38c-4478-9228-5b0bbc4f6f5b/
SH256 hash:
1dcc2630a57a85ed362bccb7a130b957b1713acdd145f7399b6dd8c62955e8e0
MD5 hash:
8763642a17fce45aa4812017fa49cefa
SHA1 hash:
bcc969039730812b9d7501247b92f06a8779cf4a
Link:
https://www.unpac.me/results/6330d6c2-f38c-4478-9228-5b0bbc4f6f5b/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/6330d6c2-f38c-4478-9228-5b0bbc4f6f5b/
SH256 hash:
de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0
MD5 hash:
fa30f2c3ae46b04496cdcea1d74e1971
SHA1 hash:
336e16f5566dcb853d9fdbefd6a7db4a3158db5e
Link:
https://www.unpac.me/results/6330d6c2-f38c-4478-9228-5b0bbc4f6f5b/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/de16643e51e2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/440988/

Comments