MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e521a08be704593a2045c00da7c999fb2a7901564db511c398fe5ff51a710bdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e521a08be704593a2045c00da7c999fb2a7901564db511c398fe5ff51a710bdd
SHA3-384 hash: 67742476d815581a9a1d4167cae09e481ac6dcf02dccd2ba636730bfa141868f8d5e34a67b3d5e18639c317f2c8efdc8
SHA1 hash: 9d257a5771ac62ce8929fcb3eac3d57f28e06ac8
MD5 hash: 9e0239d121f65455ecb7081891b0226a
humanhash: kansas-one-cup-kilo
File name:缺少发票.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:722'432 bytes
First seen:2023-08-30 06:39:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:jOMCWu9DvQnc6j1RiBPNE+g4yPzkz3+tpuvuRjaZAJMAmONq1gfisbZK9lUhRcOm:jOW4Dyq+btcGNCAmONq1Oc35yni
Threatray 213 similar samples on MalwareBazaar
TLSH T14DE4E1283ABC1F26E67DC3F98424564817F967AA257EF38C8DD174EF2660F420941B27
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
缺少发票.exe
Verdict:
No threats detected
Analysis date:
2023-08-30 06:47:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/026de57b-968c-4e2a-9f4d-dac85dceb80e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/445239/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
explorer lolbin packed
Link:
https://www.filescan.io/uploads/64eee4475ec4a8623261ca4d/reports/8ed742a6-556b-4ad2-8432-43e627b9fb1c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e521a08be704593a2045c00da7c999fb2a7901564db511c398fe5ff51a710bdd
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6c5da356-d830-4f05-ac34-b561a9c1bf6b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1300197
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e521a08be704593a2045c00da7c999fb2a7901564db511c398fe5ff51a710bdd/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2023-08-30 04:30:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4uq2bc7harmtuicfyag2psmz7mvhsakwjw2rdq4y7zp7kgtrbpoq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02bc9f274f7ba4ec93358bfa71c5b658727b414e7e6301c50fac619227a78327
Formbook
0bdde3cb5bc10aa2aa88e00599e59b6ebfb1ce24fe78dc2871ba3c8118f61c91
Formbook
2c9e58b98c0929168074d7742170d85eb83c23f97aff8786381aec250af1d6f8
Formbook
571f10fb2f8ed39463e85d4a5af98f8203489b60d7a634d890462f10d6b15f2d
Formbook
66daa727802e8f1b27219b0d589be52f080ae995f4b7392fca76b21511bab088
Formbook
7997a727f9b2d2bba8f6a846dda7f4640c5b3d1d31db85deb0ef1c4ff05574a4
Formbook
8e050001e6fb1e5b3ae36eaa585d0cdd075dd80fb44cfb7cd6c058da03c71027
Formbook
9ef1acce35cd1f22cf8d2e59dd9ff59a284631d403d27e1413444ec00ad45542
Formbook
affc74db906a6b57d940a90471204922b9778426e1defb4be5b645308b1a3da5
Formbook
+ 203 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230830-he8bwadc7z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
4d731c5206f96365adab326003f2c41622a7e546e447876b5352fc52ca38f404
MD5 hash:
0e248bb3c32ec890c51157b03e0de992
SHA1 hash:
365209e6c3aec46b09107404b781c22500bb1801
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/e757b635-8cfa-47ef-8eda-5eac9f565253/
Parent samples :
2c9e58b98c0929168074d7742170d85eb83c23f97aff8786381aec250af1d6f8
9ef1acce35cd1f22cf8d2e59dd9ff59a284631d403d27e1413444ec00ad45542
e521a08be704593a2045c00da7c999fb2a7901564db511c398fe5ff51a710bdd
SH256 hash:
18d65ddda9726a1e1900b0df3ae460bac26238ace3602a4e05fb8196e9cc3ac5
MD5 hash:
85fcc3aa54d50cf780845c6a439f9185
SHA1 hash:
7e7933c406d7ce1bdb186899ec806a877c884c58
Link:
https://www.unpac.me/results/e757b635-8cfa-47ef-8eda-5eac9f565253/
SH256 hash:
2ac2f55e15fd8da559f99925ceee9166ca978e94cbc53a5cb29bf02d0a76ac7f
MD5 hash:
1081db0b25581c7958e6fbff4d9aa64a
SHA1 hash:
bcb0e0fe844884a5b0d05cd3b0cc5fd7a5ff53b9
Link:
https://www.unpac.me/results/e757b635-8cfa-47ef-8eda-5eac9f565253/
SH256 hash:
2a995b5b64848a9eb8fd76a8b8092290314f8277e32dd9777514f1f743655d71
MD5 hash:
b64f9b22dbc01029545a7755d42c00e3
SHA1 hash:
b562d820f62236292a5f63a80751960cffed9e06
Link:
https://www.unpac.me/results/e757b635-8cfa-47ef-8eda-5eac9f565253/
SH256 hash:
c55c653adcdfef94eea5964f900179e4c1ac2fbb2b65c23e1682f7ac4f6d6b0e
MD5 hash:
980d4209173a7681c7b6b81762a6da2b
SHA1 hash:
8d4c53478d6a2cf058d2b91c1354af3b96bb2d94
Link:
https://www.unpac.me/results/e757b635-8cfa-47ef-8eda-5eac9f565253/
SH256 hash:
e521a08be704593a2045c00da7c999fb2a7901564db511c398fe5ff51a710bdd
MD5 hash:
9e0239d121f65455ecb7081891b0226a
SHA1 hash:
9d257a5771ac62ce8929fcb3eac3d57f28e06ac8
Link:
https://www.unpac.me/results/e757b635-8cfa-47ef-8eda-5eac9f565253/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e521a08be704/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/e521a08be704593a2045c00da7c999fb2a7901564db511c398fe5ff51a710bdd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe e521a08be704593a2045c00da7c999fb2a7901564db511c398fe5ff51a710bdd

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/445239/

Comments