MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8aefc580523d6bd8d0c356333e540087f3ab3c96cf153f0d33188e5c4b54510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e8aefc580523d6bd8d0c356333e540087f3ab3c96cf153f0d33188e5c4b54510
SHA3-384 hash:	a559c1a80f18ce5308e939b0de5546883d75663ab452dc8a45405d2f0ce5ad412a29b90332206f286cac550a56374617
SHA1 hash:	cdc1ad01d3188379848cf08575ec4e86eeff3700
MD5 hash:	8dcb32043c0fd55f9b13b3741c85ed25
humanhash:	pip-floor-alabama-papa
File name:	SecuriteInfo.com.Trojan.Inject4.59820.4559.1625
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	686'592 bytes
First seen:	2023-12-14 08:29:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:+c0oLtpF2IX1sscCY2UZtc5r7HfxObzYFbrItN:+zgT8IXK2hhdDJObUMt
TLSH	T1D2E4CF4D57204297F0082B75DABD3F1A02601C7C79D1EBE4F9A67A1BEDE6BA6143301B
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	6dd2d312dbc8cc49 (94 x Formbook, 5 x AgentTesla)
Reporter	SecuriteInfoCom
Tags:	exe FormBook

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

350

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox Formbook

Detection:

Formbook

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/467437/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Inject4.59820.4559.1625.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/657abd11eba10803148abb00/reports/67f3a83d-864f-4a8a-961a-ad090313ca21/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/e8aefc580523d6bd8d0c356333e540087f3ab3c96cf153f0d33188e5c4b54510

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Formbook

Malware family:

Formbook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/504ce14b-b63d-4351-9cb6-91966878bb2a

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1362031

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/e8aefc580523d6bd8d0c356333e540087f3ab3c96cf153f0d33188e5c4b54510

CERT.PL MWDB formbook

Detection:

formbook

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/e8aefc580523d6bd8d0c356333e540087f3ab3c96cf153f0d33188e5c4b54510/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-14 05:46:58 UTC

File Type:

PE (.Net Exe)

Extracted files:

8

AV detection:

18 of 23 (78.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5cxpywafepll3dimgvrthzkabb7tvm6jntyvh4gtggeolrfviuia._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook campaign:he2a rat spyware stealer trojan

Link:

https://tria.ge/reports/231214-kd5wgadhb7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Formbook payload

Formbook

UnpacMe

Unpacked files

SH256 hash:

e8aefc580523d6bd8d0c356333e540087f3ab3c96cf153f0d33188e5c4b54510

MD5 hash:

8dcb32043c0fd55f9b13b3741c85ed25

SHA1 hash:

cdc1ad01d3188379848cf08575ec4e86eeff3700

Link:

https://www.unpac.me/results/ef96b068-8a19-445c-ae70-a9d4a9f5c817/

VMRay FormBook

Malware family:

FormBook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e8aefc580523/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e8aefc580523d6bd8d0c356333e540087f3ab3c96cf153f0d33188e5c4b54510

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/467437/