MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef201fa6a83547a8b5a1514e948d4208ee20bd4d37c1fe57d81bb1c2dfb1caf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef201fa6a83547a8b5a1514e948d4208ee20bd4d37c1fe57d81bb1c2dfb1caf5
SHA3-384 hash: ecacf3b14276e086d3940a50ff4b49af9d6d09198faaec1c81b15bb8a9e2b53fb066997656914be307b049a7117935d5
SHA1 hash: 6e4d3fc6bc3552d8f1304c60c3b1b9253792a97b
MD5 hash: bcc2ef5edecc627633a5c2655b5422dc
humanhash: alpha-hamper-idaho-triple
File name:Purchase Order_231313_20230.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:623'104 bytes
First seen:2023-05-16 15:19:06 UTC
Last seen:2023-05-16 15:40:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:zYyv5+7XdJV1D0K6E2RzIDLdeKiLk71tb88:V45J6BcDoLI1t
Threatray 2'845 similar samples on MalwareBazaar
TLSH T1A0D4E17060AE4690F01FCBB165B8FD72027270F3AED9D9350729A1C4CE6AF546E88D5B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
269
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase Order_231313_20230.exe
Verdict:
No threats detected
Analysis date:
2023-05-16 15:20:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1b523102-8988-4ef5-873f-187f99a9f58d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/390506/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1966.4286.19446.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64639f2599100c283cd25e95/reports/a632253d-cec7-4654-80f6-d3cad9b0ff89/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ef201fa6a83547a8b5a1514e948d4208ee20bd4d37c1fe57d81bb1c2dfb1caf5
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/604aa3a6-9c22-46ff-8086-179430c866d4
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1234639
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 867623 Sample: Purchase_Order_231313_20230.exe Startdate: 16/05/2023 Architecture: WINDOWS Score: 64 21 Multi AV Scanner detection for submitted file 2->21 23 .NET source code contains potential unpacker 2->23 25 Machine Learning detection for sample 2->25 27 Initial sample is a PE file and has a suspicious name 2->27 7 Purchase_Order_231313_20230.exe 4 2->7         started        process3 file4 19 C:\...\Purchase_Order_231313_20230.exe.log, ASCII 7->19 dropped 29 Adds a directory exclusion to Windows Defender 7->29 11 powershell.exe 21 7->11         started        13 RegSvcs.exe 7->13         started        15 RegSvcs.exe 7->15         started        signatures5 process6 process7 17 conhost.exe 11->17         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef201fa6a83547a8b5a1514e948d4208ee20bd4d37c1fe57d81bb1c2dfb1caf5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-16 13:00:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=54qb7jvigvd2rnnbkfhjjdkcbdxcbpkng7a74v6ydoy4fx5rzl2q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1d362a46e002c187e1ad022dea2fa97809a211c9ba763cfe63600d893fa3ab08
Formbook
4c8180c106fdf8c5c144e85b22eae0ce157372378310a1b7252326e6521a1b2c
Formbook
5a46bd65bf5067b29396df720a7f67abb3a773ee9ffa19587242bfeb6f5c4d15
Formbook
9d53f6d13b02326eca5357286c0852c653dd17f8459eb30dd0086fe2ef2f9049
Formbook
abbf85558290e3fa302f88f51243e5216f24c9bc4fce64a0f616db3be2c46e8e
Formbook
cc9fd84fffa1811ef3177586d7c6aee88dc4dc5412fd658ee4bb36ff934eec01
Formbook
cfe9062e6bd88ae993c3e8b295386c2e5e9aa7d8b9ceb168f56ccd3e0e5cbe36
Formbook
d549aca33462425f1f32e75b6635986df724a63b6f738247d4be19de580bc899
Formbook
ef201fa6a83547a8b5a1514e948d4208ee20bd4d37c1fe57d81bb1c2dfb1caf5
Formbook
f6bb03b4bffe8e0ab71cd8e26a65b3baa5f870cee4e974851dce6d8140316c84
Formbook
+ 2'835 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230516-sqrhlsad8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
5d1584ab775797262e65e183ecef68a622552bca362d4b07ed19650a4ec7ea7e
MD5 hash:
c2eae40dd239b983b2cd1fb9484c2142
SHA1 hash:
61d2112c6da076728867277ee80e2c2ed4615d4b
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/dcf262bb-f512-4c8b-a5e0-6400f1f76b07/
SH256 hash:
9e9280e89420f59eea26f6ec1456a984715e3d7b901cb9b966cf592e37e503d0
MD5 hash:
18ebc727da1cdfbf179b0672914ed77b
SHA1 hash:
a9e52cf9cab9d731cb48eb3e6232181c9cdccc54
Link:
https://www.unpac.me/results/dcf262bb-f512-4c8b-a5e0-6400f1f76b07/
SH256 hash:
8749ccb4ee30950445ad5f885031c696b47f139f95ba7aa73cc4eb861bcfad39
MD5 hash:
38b906ef666d44396feeaefc6c1b243e
SHA1 hash:
aeeb0aba54473001a6bf6a939d392c91267a3dfb
Link:
https://www.unpac.me/results/dcf262bb-f512-4c8b-a5e0-6400f1f76b07/
SH256 hash:
784d9d2f8efb172ba6ee473f1d0613973ccfbf183c24840eab0c984c9cfdec26
MD5 hash:
91724f35993c673b9e36896f22661e8f
SHA1 hash:
9d4f3ee4b6b67253f0ea92bfb8987c03b7be76c5
Link:
https://www.unpac.me/results/dcf262bb-f512-4c8b-a5e0-6400f1f76b07/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/dcf262bb-f512-4c8b-a5e0-6400f1f76b07/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
a7485443b331c2fca54197f53638cb11a8c82bac339b66f35b95d0ad0aceb438
MD5 hash:
dfca41d2838170cb07ef445bb7d9c987
SHA1 hash:
7622672bed23f065cafdf2a17879ebf5926aba8b
Link:
https://www.unpac.me/results/dcf262bb-f512-4c8b-a5e0-6400f1f76b07/
SH256 hash:
ef201fa6a83547a8b5a1514e948d4208ee20bd4d37c1fe57d81bb1c2dfb1caf5
MD5 hash:
bcc2ef5edecc627633a5c2655b5422dc
SHA1 hash:
6e4d3fc6bc3552d8f1304c60c3b1b9253792a97b
Link:
https://www.unpac.me/results/dcf262bb-f512-4c8b-a5e0-6400f1f76b07/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj cb95c84c76d9fab78e073b407d225cfb678fe4ad7ff5091c2a4543ba7f81dbe0

Formbook

Executable exe ef201fa6a83547a8b5a1514e948d4208ee20bd4d37c1fe57d81bb1c2dfb1caf5

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 cb95c84c76d9fab78e073b407d225cfb678fe4ad7ff5091c2a4543ba7f81dbe0
Cape
Cape
https://www.capesandbox.com/analysis/390506/
  
Dropped by
MD5 7e15632b5a8b73c85f21e9f335e736c6

Comments