MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c
SHA3-384 hash: 82c1bdcc744519be7aa222f3720808a02d212dee0dd785a6c5452e149e26f1dd4bd479f988d09fd312835dd567f37ab0
SHA1 hash: f1bdb8d285513702d8c67196c28423fe95de6419
MD5 hash: d253cfb14d2a7e9b66d244b0590923d7
humanhash: river-winner-golf-fish
File name:OVERDUE PAYMENT_USD289.000.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:637'440 bytes
First seen:2023-10-22 07:22:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:a/jf1WfNuf6W9B847QzNj8Z2kszpf1CFhPk8uaoI5IBTnBzjAPQ:aL2NS6C3IhYsaFhPHpmBT
Threatray 155 similar samples on MalwareBazaar
TLSH T104D41278739076BEC817853A5AE40CA4C73034AB532FC65BA4572589DE8DB9B8F102F3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon c02b1733b21723c0 (13 x AgentTesla, 10 x Formbook, 3 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
291
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
OVERDUE PAYMENT_USD289.000.exe
Verdict:
Suspicious activity
Analysis date:
2023-10-22 08:35:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9c151ce7-8f7e-40c8-9c95-09cd79bc6dff

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2430.21154.23499.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6534cdd84678fc28dfc3fc0b/reports/caf7d37b-fd26-452f-992c-315571abeccd/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c7590708-c809-4a44-9bb2-9df3a7f8f8fd
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1329921
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-10-06 00:30:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5uva44bjjtek2eedcj23iyxegdc6btvfkjp3xloppbv5qgyriqga._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
0b4976a43a547ad971fbceda4c867b8cf1d70a7495af9703758e4829365377b8
Formbook
3bc486f0fe0705dc71bd7f103965c5708a878f908ed0ff11ab973af842805a80
Formbook
62ada442852dbc19b06705e9c1357acacdc8a964d61402df870366989501d5d5
Formbook
7d489f696a0cc6d2b4f6a046bfbfd575d3bc2a55df7be21d8359d406f677e533
Formbook
846cde55897a66226b2f27e8449a44e2a43104674d4c14b2dd9a937c1d819f21
Formbook
942dc34e908c79f017a488c349ee4702f6a4e55d1e34210bd94152a4d0e97d70
Formbook
aa06f9712e5468f9df30cd124b2f26d9d5a3f2eb46fa23af594ced8b7c69322f
Formbook
ac10fa3a6b7cfc8385aba614ca8f0da49fe6b0cb6f1b939ec0f0046ecf80ca64
Formbook
ea2adbcb61a20497bc442d31600336a93659f5b38ee367fa83c0a996b0912e83
Formbook
efb834b38792a7c5f000b0683aa6fb5999fd2c0d6dfda9ba417f990fbe1041b5
Formbook
+ 145 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231022-h7tdesfg85/
Behaviour
Gathers network information
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
ffcda4848c844656d1fc7d57935f65e6bfe87f1b07499d6d31f82a98da498917
MD5 hash:
793f671a255ad5d76c139fc0f2fa3c36
SHA1 hash:
f83beea17210544c65e10a0f10436a37e0ac9699
Link:
https://www.unpac.me/results/923d324b-2923-4ab0-88a6-5e4276fbc74f/
SH256 hash:
828334475398c1664fc5e5e15712e6b7f28a7f56559c5903d0b00d0da558bcd2
MD5 hash:
432f83fba346b8d97bc8a7d3b519c478
SHA1 hash:
42232ecf4cb3dc64346ffd34d8b384248c726309
Link:
https://www.unpac.me/results/923d324b-2923-4ab0-88a6-5e4276fbc74f/
SH256 hash:
b1270dc9ec3f22c6fd2296239426ac7c48589589580d4a1b3da8188920b22a63
MD5 hash:
5c904da8528cfb1b87b15a6aa7c059cd
SHA1 hash:
f0a192969485d1bc34bf52adf37d9c20176d6b85
Link:
https://www.unpac.me/results/923d324b-2923-4ab0-88a6-5e4276fbc74f/
SH256 hash:
af10a81d30ea6c14a0857caa64697f78672a941419d679b34eedb82e080ad46b
MD5 hash:
ec0b80883f0b18fb75a48dd18795f514
SHA1 hash:
afe9537c27362b6769a1df0ad414b8e58d34ea40
Link:
https://www.unpac.me/results/923d324b-2923-4ab0-88a6-5e4276fbc74f/
SH256 hash:
fec43d59ed8aaf143b4c35a946dc13e91219e5e077f342a7be8d1fc516449436
MD5 hash:
3889f04e8445e80a391efe396e480154
SHA1 hash:
61c12a1a0213297a2d890b098054fa36e904eb4c
Link:
https://www.unpac.me/results/923d324b-2923-4ab0-88a6-5e4276fbc74f/
SH256 hash:
ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c
MD5 hash:
d253cfb14d2a7e9b66d244b0590923d7
SHA1 hash:
f1bdb8d285513702d8c67196c28423fe95de6419
Link:
https://www.unpac.me/results/923d324b-2923-4ab0-88a6-5e4276fbc74f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments