MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290
SHA3-384 hash:	90566a2caa51d1bf34249f73ceafabac36b0baa93c28a6ac47b1de3463568b49d741d88867f34f42087aad0be898b2df
SHA1 hash:	b0cd55fd33a1ec4d2f5996c8d8e015356b21d188
MD5 hash:	68709ebdc8c71fd1d0888b2b9a903aa7
humanhash:	eleven-jig-snake-cat
File name:	IMG-22052023.exe
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	329'216 bytes
First seen:	2023-05-22 09:38:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	97d476407c8713e8d8094dcaf80101c6 (3 x RedLineStealer, 3 x Stop, 2 x TeamBot)
ssdeep	6144:K+FDIsIRnnBvu/8xzCUTwTQOgGB5W7FdDomFyuNmlgbI:KkDIsMnROeZTSQWBogAAlgb
Threatray	2'888 similar samples on MalwareBazaar
TLSH	T1DB64E02237818072F16359300DB1CA768B3BB87297711ADB6BC45A7D4E727C2DA3A357
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	bae6e496d2ceceb1 (1 x Formbook)
Reporter	lowmal3
Tags:	exe FormBook

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

283

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

IMG-22052023.exe

Verdict:

No threats detected

Analysis date:

2023-05-22 09:41:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/30ea970c-64f0-4f35-b4fc-634e4e6ad278

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29323.BadIN.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Сreating synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/646b3836dd54de40a7f0bc0c/reports/1ec2bd38-4466-4578-aacb-f8b062a20836/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Formbook

Malware family:

Formbook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/762ad24d-8c6d-44cb-9183-a82c93299944

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1240127

Signature

Contains functionality to inject code into remote processes

Detected unpacking (changes PE section rights)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-22 09:39:05 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

18 of 23 (78.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5y2yuai4yxfx7glwqwshevn5h27h2frsyxqjbgpv64dwprigckia._file

Threatray formbook nanocorerat

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

nanocorerat

Alert

Create hunting rule

Similar samples:

13c4ed220256fb2dfb95631c042d9eadf977bd2dc5e4aa0898ab99bd16d33ef7

Formbook

326165a2f6e94ec16dfcead4602ded488925b4d4bd32b04458bf2416cdf9b93a

Formbook

3a22fb14f837309023971bf41b88cfc9b3ae7d9db44da63257d36d73dbd716ad

Formbook

6f4246a44c4b69ed8cc30d0583be906c7a8040216321889da1bd74ba7815aedd

Formbook

83655561bbc25a8d8d3e737bed283be32e228982310731a9640000797cd520b3

Formbook

8e067a63005c0cb62a0db614acafc9e1964bfd5520c13075d04879fb2aa90451

Formbook

a5976236ba0b3e31a6dd09af3abe7d0121a4053bb22669869a874d1ba97bd495

Formbook

a9c993b79501ed32742c5ccfd04e3c47d75fd26795fd87bb3dfc288384de7be3

Formbook

abbc3fed4f82fe9afe22de485ec621e13bb0890d633e9c57ba5ebb2fe66b7159

Formbook

b3811fa28d3e22cf5029476f6870c54e7fcd4d68da1342bb199ca6d41ed9ff56

Formbook

+ 2'878 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230522-lml1dsab8x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks computer location settings

UnpacMe win_formbook_w0 win_formbook_auto win_formbook_g0

Unpacked files

SH256 hash:

34b16d9aa34a06209411186e956239c1877e490dd9b6306aca2b8537066b63d9

MD5 hash:

26afa958b72d27bea25fdefb55e8731f

SHA1 hash:

acd603736e0b670ca198059d61c8cd3884aa5c56

Detections:

win_formbook_w0

Alert

Create hunting rule

win_formbook_auto

Alert

Create hunting rule

win_formbook_g0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/b2ebd0c6-3427-49ce-8328-0372f50e474e/

Parent samples :

ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290
688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541
29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30
f6b74362f5c3be4483dfeea056310801a4694ae9f8ed0f42c2ac99c86c752880
44bea404825374b13944297270be55bb2e18c7b95b2c7051800e4fb2d5fc2dbc
a15e826b6d0b658c57976684b1d2d20459ac7e5013f5cdeb12bfa2c8ff7359c8
4a4e3d020a90d81969f2458b4de891ac4cf1bc2b4e0c15eb42e0a0a26a3b66f3
52cde2b88aa65fd327813294d67dc3cc10ffaa1774acc0c7a5d40de397de2871

SH256 hash:

0abcaa4dd531ab1cd2b6eb8dc6b017da8c25f8168f647cfc2d5bdf6f792e1559

MD5 hash:

d62e812dd0ed624a487f87ee35c37089

SHA1 hash:

acf85b6fd0d54f81a5cb647d734cf3fe01aebc3d

Link:

https://www.unpac.me/results/b2ebd0c6-3427-49ce-8328-0372f50e474e/

SH256 hash:

ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290

MD5 hash:

68709ebdc8c71fd1d0888b2b9a903aa7

SHA1 hash:

b0cd55fd33a1ec4d2f5996c8d8e015356b21d188

Link:

https://www.unpac.me/results/b2ebd0c6-3427-49ce-8328-0372f50e474e/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290