MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 36abbef320573be77f282a10faa2413d38710d336ab7c61eb31a8f0ee572f6f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
FormBook
Vendor detections: 5
| SHA256 hash: | 36abbef320573be77f282a10faa2413d38710d336ab7c61eb31a8f0ee572f6f6 |
|---|---|
| SHA3-384 hash: | a3fa09e219d7f5604cad5fc670f1263433f3e6f86781c28ca83b20c6f741e8cf742865a14e47bad16cce1373bee83fff |
| SHA1 hash: | efc684da67942642d7e035f4a9061323ca129aa0 |
| MD5 hash: | 4f982d15ccb22d48bf458e4e9bbccb1f |
| humanhash: | lithium-floor-king-salami |
| File name: | Kmquazw.exe |
| Download: | download sample |
| Signature | FormBook |
| File size: | 1'254'912 bytes |
| First seen: | 2020-06-12 14:24:00 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 70411d486e9bd9bdaaf2d4939bbd54bc (1 x NetWire, 1 x FormBook) |
| ssdeep | 24576:6aXcbtJOhBn2j4byGtIW3n/jlToooooooooooooooo:6aXqO2sbyGxToooooooooooooooo |
| Threatray | 2'233 similar samples on MalwareBazaar |
| TLSH | E1456C22B7914C33C1331A3DDC5B9679E82ABE511A24A8C62BF83D789F75341392D1B7 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Remcos
Status:
Malicious
First seen:
2020-06-12 14:25:07 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
netwirerc
Similar samples:
+ 2'223 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Score:
10/10
Tags:
family:modiloader trojan
Behaviour
Suspicious use of WriteProcessMemory
ModiLoader First Stage
ModiLoader, DBatLoader
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.