MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27
SHA3-384 hash: 1fc3340dedacf6d092a16812fc7fadf291391e73f5526834fbade30777ca2f6297a852e1e9b8fd5778c51e4330e2ddad
SHA1 hash: abcdf8eac1b0e93b01d6c5a737f32ef4f584b533
MD5 hash: 198914f04413915d3d58a5f34b405891
humanhash: xray-equal-comet-georgia
File name:H.K cupbord.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:728'064 bytes
First seen:2023-05-25 08:35:22 UTC
Last seen:2023-05-29 09:53:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:qaWIm6lVvtzZBEP85HTM49TRAGb+Bw4jVfwuTgMgWd17kJRSg7JTFb4nhMX5:zTmIt9BEP8VM7BTZwuBVg7JTFk
Threatray 2'949 similar samples on MalwareBazaar
TLSH T178F423E4288A47A9DAB7073004167AF0177F8B8A7977E7A74D47B6C9FE10F454A4A303
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f89cb2b02cb9f060 (7 x SnakeKeylogger, 5 x Loki, 3 x Formbook)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
249
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
H.K cupbord.exe
Verdict:
No threats detected
Analysis date:
2023-05-25 08:44:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7e94c46e-9ba4-42c5-bfee-d1476fe116a2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/391478/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/646f1dfc1d162541e4be879f/reports/349e4f47-cdc0-40df-9bc8-1f09085e766e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a2dfc841-0c6b-4cbf-b588-a2dd11d36133
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1242334
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-05-25 08:36:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4wtv5u5bmtjsej426fb4abycrjpjjjjmchspuz2mg6siy6jdputq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
00e18c9bceefb7ce5810a575af9f6325dabc4d2421a447433629f2e29bed20be
Formbook
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
Formbook
2484f3b9e112f39471b0375d98ac190b4ffe3e29a295bcecdb8fd7b71af0094b
Formbook
4627b5c64c1c639a6930dd1f9f135e396853e6bf418c8c0d3c6eaec18b3cdc12
Formbook
79f878be696492904510496633fcdc7458f7b2e2efb373f7d097b2276a708e51
Formbook
93d900164f8df22ed262ffba777f1138271b7c5982948c0e8115e59a3dce41ee
Formbook
abbf85558290e3fa302f88f51243e5216f24c9bc4fce64a0f616db3be2c46e8e
Formbook
b0ebf928b4df7f41c89599e1e1320fb1d44e36e1d5a3055b376c82b912fdf182
Formbook
c918d1ae4c1635db9333c72fa06a6b04afa4a2ab37f494cd24c5e3fbc6963ead
Formbook
e8f271e2c00c7310ba76f5be24f425df7b4c3fdd84a0b715906a10da4f7e879b
Formbook
+ 2'939 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230525-khk2vsgh95/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
1bc00323ba02f4d7b8020d1e3feb7c7d0b2b4d4eae3c02613f533179740dd10b
MD5 hash:
d252c5f1e177249b467c6e81ee50e917
SHA1 hash:
3071014db2840ccef5959b7394748dfd85bed3d0
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/cdb27bfc-871b-4e14-aaad-bff7c07da3d4/
Parent samples :
4627b5c64c1c639a6930dd1f9f135e396853e6bf418c8c0d3c6eaec18b3cdc12
00e18c9bceefb7ce5810a575af9f6325dabc4d2421a447433629f2e29bed20be
e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27
SH256 hash:
8a38ca1ef4c48d89b9e92667aed07c046fd4765c11eac2a76ef1c2750c32383d
MD5 hash:
4063ef5cb280a735fdf45fbb5fff9cf5
SHA1 hash:
7d2a51a81714e236b2bfff434095be9e3dc15ee2
Link:
https://www.unpac.me/results/cdb27bfc-871b-4e14-aaad-bff7c07da3d4/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/cdb27bfc-871b-4e14-aaad-bff7c07da3d4/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
b2876080a8892ec02a11cc322cc18952d45f9e419c1cb6d4d070860c59fe87eb
MD5 hash:
803e0c67b76960ff5d9ccb360ba9636b
SHA1 hash:
836d339682618638c6b2e3d156ad66a56e4f9ba5
Link:
https://www.unpac.me/results/cdb27bfc-871b-4e14-aaad-bff7c07da3d4/
SH256 hash:
06a141d20be804eec41070c22b997833f36c7890259bdcb06f0d1a2b3586cfbf
MD5 hash:
c7ebf2e15196a52a9ae586eda36c3682
SHA1 hash:
7c03388b6f26948bfe24e471c9bb7869b71e792a
Link:
https://www.unpac.me/results/cdb27bfc-871b-4e14-aaad-bff7c07da3d4/
SH256 hash:
df4a96b3ea6ef13d18bc493de7c3dcee30ed0f20b2b895f82e7f6ab77635484a
MD5 hash:
70719f25be9882baa56301d54040f6f3
SHA1 hash:
0c85b0ac1ef6b39087b33d1b10f8c91522724319
Link:
https://www.unpac.me/results/cdb27bfc-871b-4e14-aaad-bff7c07da3d4/
SH256 hash:
e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27
MD5 hash:
198914f04413915d3d58a5f34b405891
SHA1 hash:
abcdf8eac1b0e93b01d6c5a737f32ef4f584b533
Link:
https://www.unpac.me/results/cdb27bfc-871b-4e14-aaad-bff7c07da3d4/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e5a75ed3a164/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/391478/

Comments