MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5afa7413d271eb60f89be735d02aee02bb7390c022eeadf46ff30448416995d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5afa7413d271eb60f89be735d02aee02bb7390c022eeadf46ff30448416995d
SHA3-384 hash: 47aae255ee96733032b1596e309cd8a1e35545668462879774bef9304d44ce9ce70a10fda297fed061abbc029d9dc288
SHA1 hash: 7e076603f6be2c7cb5762875a423c059b6b1396a
MD5 hash: 1da62988e49c14d4638f06b9eb87f54f
humanhash: california-harry-pizza-nine
File name:SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503
Download: download sample
Signature Formbook
Create hunting rule
File size:1'061'888 bytes
First seen:2022-11-08 15:44:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:TUEkCMDIQH5DdjUyBxMuDNTndn9kP4sjmDMJVKNb91IZCBKdWA2LM6oShKa7Q:TUOQbH5xBSuz9+jm3bbIMB+WAeLAaM
Threatray 16'242 similar samples on MalwareBazaar
TLSH T10335C0A034B02FB9D67ECFF64629262483F32DA9625EF24E4CD170EA1573F924660D17
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13097/50/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503
Verdict:
Suspicious activity
Analysis date:
2022-11-08 15:56:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/aa5c4730-74c1-4668-bd17-6d3332e82780

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/330674/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/636a7988c0dbe6b5f9a4b493/reports/b6fe9543-9f32-4cdb-a21a-5e8406734122/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/64e1d186-9063-45f8-9d7e-b8bf3f291c6f
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1108357
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5afa7413d271eb60f89be735d02aee02bb7390c022eeadf46ff30448416995d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-08 11:11:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
31
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4wx2oqj5e4plmd4jxzzv2avo4av3ooimaixovx2g74yejbawtfoq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
4514fc2a757de12c765ce8886024f9e88a24e8c716001b911fab3fa693fcbdb1
Formbook
4c3d925669944dbdec6649638901b8ccb110c2ff971d8cf558ef05f9980ecf69
Formbook
685d62ac47d37b18c403cc1d1923183bc78c11f4c1b18a95efe17521e704e96a
Formbook
7b00599838c328e0b0f684cf8afb33a2e60be3a7e470151541e5ca9cce64d2ee
Formbook
8a44adde0f3cad02f2cfd6f4694a8e4455acd991bbe25520cf6bafe0839ed09c
Formbook
8a93dabd3dda5548c792f3064979a25a5770e5870a8d9989a0b16b5f2cc56204
Formbook
9de05e3460e7b565c614eddca75b9b08b697f9b21c3b4da6fd88e8d7b2d11a90
Formbook
d638e7ea6048de830f145ff0e37950b009c10da0b49be87a145a9418541a0cdd
Formbook
ec81ecfe0f57e6ce43b9c5b605deead6f3d3c6f72a94e2d2bc14d6b0bda004c5
Formbook
ed575e87b8ddb54cdd3f247dc89ac394081bbd503cbd6b29d1a4592d60aa07a6
Formbook
+ 16'232 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:e7nb rat spyware stealer trojan
Link:
https://tria.ge/reports/221108-s62zaaedc9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook
Unpacked files
SH256 hash:
db6ae0ccd2db56b33660156b9fb27c0f81a1c35e171f3464627d432eab2619ef
MD5 hash:
13359d2c2b1ab26168847e365cd43773
SHA1 hash:
97764b4ac49b29c23c7da8f746c12a2083c52d50
Detections:
XLoader
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/9822e7ce-e501-4a55-8929-1b70d204d5c7/
Parent samples :
7f0d2570e95993562f659f45e635df91b3155a8c220bc1b859f1cf838bb66278
da37c66e5cc323386f9637b402df14fc02cd76eb9abc6853a458d266db163088
b78a810a8191aa868b43012e177e7fba672974dfb438f31405caea35beb75a48
67dfdca1a2d42035d8ef9bde053531051793e2f13e30b8f1fe0a81fdd52e99fb
e5afa7413d271eb60f89be735d02aee02bb7390c022eeadf46ff30448416995d
71dcac38a6bf66dfc49a933ccfcf01bfce78edc276d11ac181b2924ebf0b9e42
SH256 hash:
41b028c61e5d5e961a675b3fcbf760e0495aaed32681847a01e2b0e9be704bdf
MD5 hash:
b7fd0ed124454c48dd419306d4e2acd9
SHA1 hash:
9ae87d0a7f0fdb2964b5986a229753c49d467a0e
Link:
https://www.unpac.me/results/9822e7ce-e501-4a55-8929-1b70d204d5c7/
SH256 hash:
13e80fde971ff150ba6cc8008a9be6c02401fa85925b91662b84f1da7b0826d8
MD5 hash:
0d529117d051d9f40242787b84fe9e0c
SHA1 hash:
90623a4bc25293f51803b60cdcad2e54fbcee67f
Link:
https://www.unpac.me/results/9822e7ce-e501-4a55-8929-1b70d204d5c7/
SH256 hash:
cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4
MD5 hash:
aabd0bdc81026ade6c57383f21d5c227
SHA1 hash:
4b26936bb8c03be6d7963184215a5ab594ecb765
Link:
https://www.unpac.me/results/9822e7ce-e501-4a55-8929-1b70d204d5c7/
SH256 hash:
1dada86ca77647e956048bb5553670eafe08285780d70ba02f03c65a1b037263
MD5 hash:
93ee935d24507e81919800e4b53f9c39
SHA1 hash:
39802bb9aa34bc12e1e1314616114a2407bac21e
Link:
https://www.unpac.me/results/9822e7ce-e501-4a55-8929-1b70d204d5c7/
SH256 hash:
5ef6a0c3019357ac1ccef63c797e7fe4c5ec4a3ee388a9de69dde1d8edf0aa07
MD5 hash:
304161ff04c30f7e2583af57ecb98231
SHA1 hash:
15bcb5d1a112e5446a30288043015f2625ea4e22
Link:
https://www.unpac.me/results/9822e7ce-e501-4a55-8929-1b70d204d5c7/
SH256 hash:
e5afa7413d271eb60f89be735d02aee02bb7390c022eeadf46ff30448416995d
MD5 hash:
1da62988e49c14d4638f06b9eb87f54f
SHA1 hash:
7e076603f6be2c7cb5762875a423c059b6b1396a
Link:
https://www.unpac.me/results/9822e7ce-e501-4a55-8929-1b70d204d5c7/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/330674/

Comments