MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e54d0568b4987713be85f584b8311a3af96dbc703e99c0a8be6826c158120d8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e54d0568b4987713be85f584b8311a3af96dbc703e99c0a8be6826c158120d8b
SHA3-384 hash: 8352c9b650379fcbf0a012d35a1c2f068b012faa69108f20f434adf572fe3f94b8b20f02aacdf181beb0f28da2f3458b
SHA1 hash: eeafb3abad4f444196f20595a8b0ab1962c1897c
MD5 hash: b64c13b78d6dbf04651bed2bab12d12d
humanhash: mississippi-twenty-nebraska-yellow
File name:r83kGPGIDBWUCGnA.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:736'768 bytes
First seen:2023-09-22 01:13:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:bdYUw2iNtTr7PqDC17mBUwFKzS2cz5qThOOsc+HIxYo/yOhFveNSAGtu48:qUw1frIe6BBFKzKiscuAyOhF2NSAGwb
Threatray 33 similar samples on MalwareBazaar
TLSH T1E3F401513B6C9FE6D33A23F00295894523F1666A613EE3461DC3B4CF6A61F80CB51BA7
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter FXOLabs
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
r83kGPGIDBWUCGnA.exe
Verdict:
Malicious activity
Analysis date:
2023-09-22 09:09:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1ad94d2d-db33-437e-854f-eb829057e747

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/450526/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Restart of the analyzed sample
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/650cea5a33582f234eff07d4/reports/4bc8ef3b-9112-4e22-9e9d-d156ef54e9e2/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e54d0568b4987713be85f584b8311a3af96dbc703e99c0a8be6826c158120d8b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/32d131c6-6ee9-45c3-ab2f-7e927d6e7704
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1312700
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e54d0568b4987713be85f584b8311a3af96dbc703e99c0a8be6826c158120d8b/
Threat name:
ByteCode-MSIL.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2023-09-20 11:40:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4vgqk2futb3rhpuf6wclqmi2hl4w3pdqh2m4bkf6natmcwasbwfq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1290bedfe236cb0894d63d8ea46b115ff26bd7694a16ae290fdcbc91291096a4
Formbook
314b0463e6de6de56467f023dd2ddbf799d883e2e65552ddf2b87f607eedc5ae
Formbook
7d0d45caa5fb24fef82b7ab932fcfa907db162db0e7e821d3adcc457f30764bd
Formbook
96a3709a8156268f9daaeac2aab9c66146967ef173e5d5d2e8a0ed8bde75ab63
Formbook
a3ac1a13b363264a45374dbc9a485e19f80d71cefa4f3cb72a902d46c667330a
Formbook
bdb41289aeeae3103dae4fa81bdaebb88311bcc6127b1c8c1a9afc96623adbbc
Formbook
c7d4fd24bc684b1d6132f8435cba9c9120df5a08dee714985e94ef4caae17a72
Formbook
efaaf9e72db8504655c4ae81958252dff7454667d9fd559d1f3a1a4b53a3c8ee
Formbook
f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5
Formbook
fe36ee5707daa891a4902579d1ef2a98d681bf50d87982a1a331432277924365
Formbook
+ 23 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230922-blmv7abd5v/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Unpacked files
SH256 hash:
e26bae47908f415ba9a927b2eb5eea76b5afcf974a8c4cd5af9f03151cf1a1bb
MD5 hash:
5cbd4417daecb98c206129dee3d9805e
SHA1 hash:
c496278b2b095f6f139596f6e70c57346cadd4cc
Link:
https://www.unpac.me/results/f3b9c6fb-4eb4-4393-a1e7-eed675e4bf39/
SH256 hash:
eefbe47622bed3af8385f3fc7eec85dd029006d06b869ad1b062bb152f273531
MD5 hash:
fde136c4cd1af823fa0c9a75279eee8b
SHA1 hash:
2cd66a70961ee5d5de9a0430e73f76039f1839d8
Link:
https://www.unpac.me/results/f3b9c6fb-4eb4-4393-a1e7-eed675e4bf39/
SH256 hash:
4c00f6d566b9f3d3f8407d44e477db87926c08fa089a351b165547de5a07d9d9
MD5 hash:
4fb1a7084bad3b1016533fee03610952
SHA1 hash:
d099e51ce5d9790bdc706a6f703294ad595cacb8
Link:
https://www.unpac.me/results/f3b9c6fb-4eb4-4393-a1e7-eed675e4bf39/
SH256 hash:
c053e97474443e8dcc30f2b08633d21d90b4b2e5d375b03d82c09a57ebf4590c
MD5 hash:
3994d967263c2efc9895149b9b5e1faa
SHA1 hash:
46a49dcfd3a3236116b1c0bd5341c2bd37fec90c
Link:
https://www.unpac.me/results/f3b9c6fb-4eb4-4393-a1e7-eed675e4bf39/
SH256 hash:
7ec118e70613ce2d9aee29cda2918ca710dde346c68d4da75c2ea0402e6d4391
MD5 hash:
1622a62bf6805b2dca82a8632eceac71
SHA1 hash:
071b72a5a1231149dfe4b9fcfa3a6ee49265ab7c
Link:
https://www.unpac.me/results/f3b9c6fb-4eb4-4393-a1e7-eed675e4bf39/
SH256 hash:
e54d0568b4987713be85f584b8311a3af96dbc703e99c0a8be6826c158120d8b
MD5 hash:
b64c13b78d6dbf04651bed2bab12d12d
SHA1 hash:
eeafb3abad4f444196f20595a8b0ab1962c1897c
Link:
https://www.unpac.me/results/f3b9c6fb-4eb4-4393-a1e7-eed675e4bf39/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e54d0568b4987713be85f584b8311a3af96dbc703e99c0a8be6826c158120d8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe e54d0568b4987713be85f584b8311a3af96dbc703e99c0a8be6826c158120d8b

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/450526/

Comments