MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 583045552a76855fb4c6495769f7b1ea781b2d40b1965944d757f41f66cc208a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 583045552a76855fb4c6495769f7b1ea781b2d40b1965944d757f41f66cc208a
SHA3-384 hash: 1d06ad07071ab957a8263a5471ff9c7a46cf493ab841bd23b05e89c7d02ae007eee6baf11483111a70e08791072cde29
SHA1 hash: 67b03b18f63d14c60deb7da1176e5eb7807aa225
MD5 hash: ff4c03f8915bfae580722c620068f2ca
humanhash: zebra-oven-don-johnny
File name:f36ae6bb653934f74fd42b6ab09e4339.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:172'032 bytes
First seen:2020-03-27 18:08:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:1JZkH1PykPpKw4C+x/jxIVxwTgZUvg8C+K+tssjyepPwazCQ/qll:Xssa45hxcwTgZ+g8wwygwlQi
Threatray 4'847 similar samples on MalwareBazaar
TLSH ADF39E31D651C035E2B201B5B67D0B7B883E0E353695A8E5E3B12AE06FB44E5B52E31F
Reporter abuse_ch
Tags:exe FormBook GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
http://sbjadvogados.com.br/SHALLY%20FI/Apotle%20Bin_encrypted_C13C40.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Win.Malware.Formbook-7399661-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-03-27 18:35:31 UTC
File Type:
PE (Exe)
AV detection:
44 of 47 (93.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=layekvjko2cv7nggjflwt55r5j4bwlkawglfsrgxk72b6zwmecfa._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
223bbe1af0d09289a1ebeddf78e3218fcae28d0a69c291d66fee5fa29337844a
FormBook
27faaaca4acb955010d7b8c16764a536c04149f2d332f99668d6ff6f292bfc20
FormBook
322427854deccec94e7331e8d3faa9f2701289b8e2faac322889c5b04d6b8f5e
FormBook
3bd58e3b3fe712e8d7595cfbd576a96251c68a5dac230bd3e778640e8eb817ec
FormBook
5628310c6fe718d77dadbc5c8cb6238faa27942517b590c2a87c07aadca429d6
FormBook
916237116e09e4233846389b7410a8ccc7e7ef96c0ed97c3fdb19a08499504af
FormBook
9fba6ffeb90dd242748718d8272a4942496e76a4f68bdb4dd42f93b044b5ed50
FormBook
a91c5af7a94238bb1556b641b9f5bc7798133b3d699a9f3d5b88b8f8fc12f091
FormBook
ceec91127018aba0be51981277015baf08e3f0ef6fbd0a5efe5821fa698ba645
FormBook
f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c
FormBook
+ 4'837 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

73257292236b2e5356074d90ead5383b1f70de440729bc27188199ce6b04e44c

FormBook

Executable exe 583045552a76855fb4c6495769f7b1ea781b2d40b1965944d757f41f66cc208a

(this sample)

  
Dropped by
MD5 f36ae6bb653934f74fd42b6ab09e4339
  
Dropped by
MD5 5a17d8f3640ac7a79c8cf07971ed40cd
  
Dropped by
GuLoader
  
Dropped by
SHA256 73257292236b2e5356074d90ead5383b1f70de440729bc27188199ce6b04e44c
  
Dropped by
SHA256 4aec46313d64a6b6c1b9d61c77139339de28463f67a9d6d94ce4bfd04f379296
  
URLhaus
https://urlhaus.abuse.ch/url/331103/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments