MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf
SHA3-384 hash: 5000c05fbd2dbcb7945ccc12f5d399d5f3bdb076f911b5d90d64755335cdc7f045b4662cdfcaae1a2d58c1099b10ebca
SHA1 hash: 363e4d1357576e2f6a46e8d090ff67326b9e059c
MD5 hash: 69d7546a22b83d22f71ca06c9f3062a2
humanhash: sixteen-blossom-five-alanine
File name:COMMERCIAL BANK ENERGOTRANSBANK_USD112008.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:612'352 bytes
First seen:2023-09-29 09:01:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'601 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:3x7255r5zzHsaGaHuImN4xs7VLoiBRRNuVZxAXOl:ADFbHuh4SVLTNguO
Threatray 88 similar samples on MalwareBazaar
TLSH T1C8D423A478A24BA3DC9A17361ABC103A8370F660E401F7FDC99E57CF09657486972F27
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon b26969e8e8e8f0f0 (23 x AgentTesla, 13 x Formbook, 3 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6516928e32ffdb7a7a18a72e/reports/445dba0c-38c7-4ce3-b39e-9993fe7d7dd8/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bdefdb70-7400-408f-aab0-32b118ea156f
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1316311
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-09-25 06:22:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6y4uztnebbyvvntl654fptwjcunpbe7kmlorg6cryj2mvmi3jlhq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1ef0585dccde8a7c1fac3374d6d4db5abc92a24920f76b9063cfb1e5baa4f711
Formbook
2ea01def771f0e57b541d4819dd9a543c5adb3a4452c6f5c03eac2c49c542bfa
Formbook
50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7
Formbook
582b83da6cb0374b90790106f9e4b8a046e9d0b24cbd725c2be985c8c0a149bf
Formbook
6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210
Formbook
712f1dd153cfa3cdc0d32d481f58aff6b583bc7a60a94597a8c47ced99360d89
Formbook
7d0d45caa5fb24fef82b7ab932fcfa907db162db0e7e821d3adcc457f30764bd
Formbook
95216d71fff102892599ac2c3e12742cc687eb8ab3eecb475366f69a38297511
Formbook
96a3709a8156268f9daaeac2aab9c66146967ef173e5d5d2e8a0ed8bde75ab63
Formbook
becae35d75141130a7aedcba04c2161c38b3664e82dbdca5ba6a595db6c36789
Formbook
+ 78 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230929-kzfhpsae22/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
72f9dc928a8d097a8c8197d68213348cad5a0a2eeffd85205904207691d04b23
MD5 hash:
a9aa729878683b265201cb85ed9d9f34
SHA1 hash:
25cc0c8631edf703a0d86af0942d5d1956b569d2
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
Parent samples :
7d0d45caa5fb24fef82b7ab932fcfa907db162db0e7e821d3adcc457f30764bd
f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf
SH256 hash:
58142cb87448a671eb30191c7910084e4ae4c71866ff9e7e59345649c2adee73
MD5 hash:
115a128c3cc68e98bb77e271618ea672
SHA1 hash:
fa61359ff396ccd4f643f8fd406b1efb419f57d3
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
abed99881ce1e05907653d1697ae232575d0cf067fd5cc646e2e5ee9f7337c82
MD5 hash:
491a7170bd8a7ed81d03a64ff2598bdf
SHA1 hash:
8325a5bccba80878a14032c06b78b34db808b910
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
a150efbd8f4259378200596399fc0419964c51b447546835f45e0e6c53327a78
MD5 hash:
b254fbe9dec98393d177e28e9b1c22dd
SHA1 hash:
71b72948acfed7949e453e8b2ff6b704ba8b087f
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
7ec118e70613ce2d9aee29cda2918ca710dde346c68d4da75c2ea0402e6d4391
MD5 hash:
1622a62bf6805b2dca82a8632eceac71
SHA1 hash:
071b72a5a1231149dfe4b9fcfa3a6ee49265ab7c
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
3a0dade01613cdbefec73bc49d432e7b1152e7d249697f23d75d144e176b2552
MD5 hash:
82b64c32506b8ddc2cfe529d0f6302ff
SHA1 hash:
f12e30c6b58151622e3345583fa5e489371bed6f
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
b8f4ad44d93f17f56f2db7eb3abc861d3a9182c9e95a315017f0a2aa7ba825a7
MD5 hash:
f17f12749cfd6cc22cc45775e0c70197
SHA1 hash:
b05618e0f362fbf47bc989a9ee2590fdde7d12a0
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
d7531e5e1cfaf8e4fd39b5ee28197d3f7d2cbf7c981aaaa2b8dbee713ce7b7a6
MD5 hash:
8904cc78873560efb5efc36839bc9a2c
SHA1 hash:
adc7b14e403c27845be0f7c81004dcf1f013eb57
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
c6fca6b0e10c3636254a6c4c85a9f772b8e4bbb82315268c71fdf441ee10e789
MD5 hash:
1bb0db11c725e928f9da479d1dab8c8d
SHA1 hash:
9361b889d69c4073301a1362dc82a228be236483
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
32d6e4e74559e0c24e6bd41d5271dc8412bb9e8b84ae16809dcafed8e5e0e99c
MD5 hash:
e147951f80e04206c4890ba69a60450a
SHA1 hash:
9344571a4fca2241ece340e4536dc9c3ba884997
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
SH256 hash:
f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf
MD5 hash:
69d7546a22b83d22f71ca06c9f3062a2
SHA1 hash:
363e4d1357576e2f6a46e8d090ff67326b9e059c
Link:
https://www.unpac.me/results/751541c4-ad97-4e0d-960a-145717ec000e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments