MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5767bcddaf9404e411f25e457d8af27eeefa15515f415e901b6e7412708e5209. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5767bcddaf9404e411f25e457d8af27eeefa15515f415e901b6e7412708e5209
SHA3-384 hash: 5ee5cd93365f98c5fe7009ba6cb897d45cd022cafb37c06440c6e1cf8b27a6d30b24b6242a1e2b9e42d8db0d7453e4ee
SHA1 hash: 13fbce17a7b15af65ce9fae97f435f2fa53487a6
MD5 hash: 26a8ef00c1508a524647c4f1aa7357a2
humanhash: mike-march-magnesium-queen
File name:26a8ef00c1508a524647c4f1aa7357a2.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:335'872 bytes
First seen:2020-05-18 07:04:47 UTC
Last seen:2020-05-18 08:23:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3dcb6238fc1bc29ea0e884827788b475 (9 x FormBook)
ssdeep 6144:R722QNV6+7cK1bjUY4hWH2Qnrl1LXDzdkE:R7cX6ucgUvI2grlJzzdk
Threatray 5'127 similar samples on MalwareBazaar
TLSH 2E648D62A96CCEB8D93F907ABAD3CD968ECE1CB7545F5C15D438E310C53CAC1C4A6226
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 05:28:03 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k5t3zxnpsqcoiepslzcx3cxsp3xpufkrl5av5ea3nz2be4eokieq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
0d567b16454b8c3be5e7dbc796bf7049c0eb18ba9a625d6b5f45eff7202aaf70
FormBook
12cb6d99b66fe413685b633d1238a5695aa8dc77489bb8ab23f8dd15012a0653
FormBook
165a08681451ecc7ad583d97bacbc449b219a7ea3daa0355f2c77d19907a1d0d
FormBook
22f4207de77f987b6791843539e25e05ff3f6c010e805330210399e23c323b87
FormBook
51d3cb67de439aca2814ae5eda56dc730fc590ed7353aba47febc451c740f501
FormBook
8509ca4c5f81525eb6f300294703c9c66af0369374bc064ac024c9dae62c7092
FormBook
89a226afd800c763daf6097a05275bb5e100b168e8c3fa46a73807075dcec45c
FormBook
ca3ab25a8c3213aa08113b09cc4b60df1d2c440aeb0e02c1e3bd192a57f86208
FormBook
d6330004986cb2968200bad58cb3f1135e2383d9bdf6894feff0f28f952f4c2b
FormBook
fff1c46e62b2f3a4e202e05aebfc1e7d72b8b3c540912fe18f4b97dc4ab50e55
FormBook
+ 5'117 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-fhz17m7tca/
Behaviour
Suspicious behavior: EnumeratesProcesses
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.domaky.com/a0u/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe 5767bcddaf9404e411f25e457d8af27eeefa15515f415e901b6e7412708e5209

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments