MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447
SHA3-384 hash: ff552d4169691305470bb367a0bf65ffb718ddec0f589d005c08644c6a13a47d946f4c02e688e28f144dd5dde5b41f3e
SHA1 hash: 0568091db913a7d94aa0f79390971c62ee860714
MD5 hash: edcce91324050def7e045bb06be5e0e2
humanhash: item-utah-batman-lithium
File name:MAWB# 695-47123101 - PN1 MOL MAESTRO V-073E..scr
Download: download sample
Signature Formbook
Create hunting rule
File size:730'624 bytes
First seen:2024-05-30 18:37:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:9bBPJwKcI0rhsSlsK2SBcLhP+dJUGMYuo2m1qp1H1FWYj2B/VUi4mAmv10i:ZBhcbradKZChINCoXuFWYjg9x10
TLSH T12DF4223172FE0714D8B96FFA8981A38447B3E807813CD35E6CDE618A5FA73114A517A7
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
609
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe
Verdict:
Malicious activity
Analysis date:
2024-05-30 18:38:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/60c90a24-cfbf-475d-b032-a02b88c9d56a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2872.1100.28106.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6658c7caaf950bab634f998bwin7simulatehigh_evasion
Tags:
Static Swotter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin masquerade packed remote vbnet
Link:
https://www.filescan.io/uploads/6658c78fc062667a22410224/reports/4f408e5a-1903-4be5-9f77-9ec5da3337a4/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/359abf62-96cd-488e-ba9b-9bcb16e2add3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1449753
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Suspicious Process Parents
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1449753 Sample: MAWB# 695-47123101 - PN1 MO... Startdate: 30/05/2024 Architecture: WINDOWS Score: 100 28 www.cen32bro11.xyz 2->28 30 www.xbavju.top 2->30 32 17 other IPs or domains 2->32 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 Antivirus / Scanner detection for submitted sample 2->46 50 7 other signatures 2->50 10 MAWB# 695-47123101 - PN1 MOL MAESTRO V-073E..scr.exe 3 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Injects a PE file into a foreign processes 10->62 13 MAWB# 695-47123101 - PN1 MOL MAESTRO V-073E..scr.exe 10->13         started        process6 signatures7 64 Maps a DLL or memory area into another process 13->64 16 dJTxXDkfqlDErIlmx.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 certutil.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 2 other signatures 19->58 22 dJTxXDkfqlDErIlmx.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.optime19.com 45.33.23.183, 49752, 49753, 49754 LINODE-APLinodeLLCUS United States 22->34 36 www.5528981.com 103.145.22.251, 49744, 49745, 49746 HWACENT-AS-APHWACENTTELECOMMUNICATIONSLIMITEDTW unknown 22->36 38 4 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-05-30 07:16:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4dd2s5hogwqosqim5y7jx6pa63jglykamrcj3opcrdne3exhwrdq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240530-w92pgaga21/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/628e8c01-3d0d-4a90-83c8-577d980a1cfe
Unpacked files
SH256 hash:
fcca5cca37a1e3be069990cf17a2040203bb9c8a9849249aba4b55efb0e88d72
MD5 hash:
354d466cfe1a9619e0b37191fb3b665d
SHA1 hash:
99f7cb3ce436dc12825e8c9025ebcdab47009d08
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
Parent samples :
e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447
e8eac417d6b3650b3922e621cbff64aeca0848583d0ffbb8dce64f6bd331587b
SH256 hash:
4179f6faef68a82ff9d04ce9c1adda3969b95308c32f81df22e435a3f2d4b426
MD5 hash:
bd91bffc41db8a67e3a782c0021c0eee
SHA1 hash:
456c770830883a4382b40481964520acdcb7df4e
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
SH256 hash:
54892a2ad8bf464501e0f825a114b6519212c52586f18025fa7f7b5abb7df3a9
MD5 hash:
516b95a2508a195dcfd17a41016ccead
SHA1 hash:
e50a8ebffd689a4fd76a5aab73819b454ccd56f4
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
SH256 hash:
982a13a3c06dda2afc41d4ffb43fe9378b537c75893659b9474e02d2bff07531
MD5 hash:
ac4c1ef71c6d186b54df0ffa287c1284
SHA1 hash:
d0d6826ab554f1fcd04374840c7dbc81dd1e4eec
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
SH256 hash:
25b5214317428b6661d063585c9de0ceb173e0cbf529069873599ac09f179ae9
MD5 hash:
a09ba49a164d02715cea9498b85dadb3
SHA1 hash:
5cb0c737d9fb738c36ca64082b53cd2d816b6e8b
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
Parent samples :
6379fc2cce3608db3ed95f85abf8e7391890b839c151224cca1dfc64c545b4d1
655a38b1686aa4f75f6dd4f2b59c8e9e09cde9997b46bafbe4e3dee38d859c99
SH256 hash:
c85b1c5872e51289e4e93d26018ef3ea440f7f15fe30c598701c8c1db48f8a3f
MD5 hash:
6c8cf23da22ea7e74a21876a4c23f465
SHA1 hash:
f679768a8fe3f1f496a6382e431eabe3cb8b8698
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
SH256 hash:
5a936ef453d283e9e724bde958d40ca556bc7349c740a2f565ae029db7dda83a
MD5 hash:
4de8e52f5c44a39eea6033ee0f70bb1f
SHA1 hash:
aec238d11e0e47abcfc5d9e1a840b1ed90363a9c
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
SH256 hash:
397d7270913c8cd4ef5884ba2914c787128385cb7923a769e6541f0c8d03f928
MD5 hash:
6386c2cb1b6fae31a4bf8ea6099bc990
SHA1 hash:
9a8befe16eb2a3dd65df99a0d6fde9124ea4a59c
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
SH256 hash:
d0d84971ae95a73e0eb907f76dc45a3449614af97266e2f521385a6c91a87dc4
MD5 hash:
43ecdca6f20386352560f72f1d2331c3
SHA1 hash:
567e6fa1b1854a33084188ea352d4487d380c9cb
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
SH256 hash:
0d22364c80cc0c4c25e9c53247a25d8cd2d77fcdeca3ce07fec3e97a40dd9307
MD5 hash:
e77b9db57f1e700ffda6c3dcb3c37215
SHA1 hash:
44c3d014f6454e0fa1f672efeb9e180523f67f9a
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
SH256 hash:
e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447
MD5 hash:
edcce91324050def7e045bb06be5e0e2
SHA1 hash:
0568091db913a7d94aa0f79390971c62ee860714
Link:
https://www.unpac.me/results/ef42dbf5-c009-4f13-97e3-d775d0917818/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e0c7a974ee35/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments