MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 efb834b38792a7c5f000b0683aa6fb5999fd2c0d6dfda9ba417f990fbe1041b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | efb834b38792a7c5f000b0683aa6fb5999fd2c0d6dfda9ba417f990fbe1041b5 |
|---|---|
| SHA3-384 hash: | 39f680299e83b4835ce052e35bea2267394c7a79e1cd0522ac5ae2a9ae4e576836ebebd895775d731088c45765fabf5e |
| SHA1 hash: | d73c1b338469a5d5125de231f2b09c7c44c73a66 |
| MD5 hash: | 61e7842d593f985b71dcb89b1d12a097 |
| humanhash: | oregon-black-single-west |
| File name: | Sipariş 5035.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 610'816 bytes |
| First seen: | 2023-10-03 18:19:06 UTC |
| Last seen: | 2023-10-03 18:38:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:zMYnQ3j67SESV1eXl8OhA905Na+U/IVEbGU3kD5qekn2w49xq2D/ERzAnwjiB2I:zB5Na+3V6DkseC2w49lD/E9n3I |
| Threatray | 11 similar samples on MalwareBazaar |
| TLSH | T120D4F18463F19A44E3FA8FB64DF1EA444BF9B4032591D74E0C8A269D4535FAB4F00EB6 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  abuse_ch |
| Tags: | exe FormBook geo TUR |
Intelligence
File Origin
# of uploads :
2
# of downloads :
292
Origin country :
NLVendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
10/10
Confidence:
100%
Verdict:
Malicious
Labled as:
Zusy.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Zusy
Status:
Malicious
First seen:
2023-10-03 12:27:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
18 of 36 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
3ba20d6a5be92323a1f09df3795434d6b1e6e0d036e13e0d77dd7e6a698f0969
MD5 hash:
233d68361a521dc96d59e4b079256e2b
SHA1 hash:
90162f722a68ae273822153e1024d350734a8d32
Detections:
win_formbook_w0
win_formbook_g0
SH256 hash:
904a3a68107c3213648095b2e3861491f3263aa0e1273043bd55f638e62f6058
MD5 hash:
712c5955f1c0e46d5351e87136fa20f5
SHA1 hash:
56246477d23c6df72d80a673b1105d6457fb4b32
SH256 hash:
3d912b9a6efb12ccafdd251a513fcc3bcb8022a6930eedfa67f2f8b1672097cd
MD5 hash:
945bde86fe9d068b0e6ab68c65d534a9
SHA1 hash:
ff999be6e7dc399a0bf66901373df65c3fa8fd77
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
SH256 hash:
2ce3575e95571f26c4b3f71bfffdfb3e5e439ebd32994aad0d5ba9e3506d2cb8
MD5 hash:
714fc7bfbf4c590ba58cd078c13af21c
SHA1 hash:
a82b3d9f4873497c32f0034b8f7b11f69d8f84ea
SH256 hash:
d6e3afe6ed3758edf4eede0dd64faeee320c342002c16c54e67fec130b683d13
MD5 hash:
ce4d57db83ad712d9c1ed5a0a665b8e2
SHA1 hash:
64a3ee3297d44bea3918bb308d714eb08e64dba2
SH256 hash:
f5609142b98762f0d86fa8fac6982ab3e662f9dbe3077de905beb0d6ca296664
MD5 hash:
4259269e92021731d7e28a1c4922fda1
SHA1 hash:
529b19d8264d935b34bcfd8cf48b22cab8f6e058
SH256 hash:
c671190c580f714dacd75e97ab2da2732243eccb8812c5f5485fa57d0cbbfc81
MD5 hash:
0753920303d38f07a7691c0c56162aff
SHA1 hash:
3a8d37071236c75a8e67313319c1c4ddf5498e88
SH256 hash:
91b44dabf7d8cdb47b559ed127cad62c64d0d1aadfb86ec09d8e641639205e94
MD5 hash:
4309d2d91b65eb498ed9557ca88eac3f
SHA1 hash:
144da239cb95313d8db47d7cc216a77b867e371d
SH256 hash:
1199251de90cf68c050d5c926f9de5f79dc3d6bcb7c0e1f3cd4befed4e01bec8
MD5 hash:
373caf3867a0f2a83e661b62ae67bd42
SHA1 hash:
02540370f0e28df55b6ce19efbec5d8800b9b050
SH256 hash:
efb834b38792a7c5f000b0683aa6fb5999fd2c0d6dfda9ba417f990fbe1041b5
MD5 hash:
61e7842d593f985b71dcb89b1d12a097
SHA1 hash:
d73c1b338469a5d5125de231f2b09c7c44c73a66
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.