MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821
SHA3-384 hash: 981b74a9d9ba57273489cb2a2c4c020abb4136292eddb29e28219281a92a9242271714938bb5a00f2cc1a30f0fe2af7f
SHA1 hash: c4a3309609d4a0794084d7efe55c78cfdad046bf
MD5 hash: 70a0b87fc879c0ccd3c47d740b5c93dd
humanhash: illinois-kentucky-table-alaska
File name:SecuriteInfo.com.Win32.GenKryptik.EJUR.18396
Download: download sample
Signature FormBook
Create hunting rule
File size:98'304 bytes
First seen:2020-05-04 08:01:19 UTC
Last seen:2020-05-04 14:56:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0f483ee2bdd4986a3e3cd08a2045d107 (1 x FormBook)
ssdeep 768:FedcTjZSBoajQJSXu+TGXaXjjamdkgatDAmeygKTSJQAn8incRUwVlRgf5w:FUconu+oYyHTQt8g4h
Threatray 44 similar samples on MalwareBazaar
TLSH 1AA3C492B7E4900BFA3555B25BA4D7E400A6FC359D411B433AC4372EAA33E45EA4273F
Reporter SecuriteInfoCom
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.UNOFFICIAL
Create hunting rule

Win.Malware.Generic-7751004-0
Create hunting rule

Win.Dropper.Genkryptik-7752242-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 07:49:07 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ccsptob6w2t3roqtb55jzdebhxxex7phtd2mptcttpbvzimmlaqq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0f9626653c8358d4e8315b97feafe2ed604ff67a9a159d47219685b2e15c1665
FormBook
1cc84d3c06c9a283218310ac6d69e7161fd7605339b78035747c6f51021475ff
FormBook
547c80b6ac037b0496c7b47ec8e002fb08eaa303de5e14e8f46fa1ee7bb43116
FormBook
57233018ececa82dadc167ce51622ecb6b06a4c08753c951a2a5e91f4b3629de
FormBook
991c4166a2246ca5ae9186a1e747f5eb767fdbd304dbfa1c5f4a2019cb6b4aec
FormBook
a46358caac50799c82a9cdc45a3718bf519ffe5d32527fdc94843cf7bee487d8
FormBook
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
FormBook
c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30
FormBook
d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305
FormBook
e6ff6d164a876c50bfc4a6f7b6397914f9656d0e4aef1ceba65f1e92ed1b6c69
FormBook
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-35prymxdfn/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent state file
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe 10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/356741/
  
URLhaus
https://urlhaus.abuse.ch/url/356784/
  
URLhaus
https://urlhaus.abuse.ch/url/357029/
  
Delivery method
Distributed via web download

Comments