MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62629c366ee55b4376c03a63e8f94e121a3ff7cbecfcf22d0158515446a9457e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62629c366ee55b4376c03a63e8f94e121a3ff7cbecfcf22d0158515446a9457e
SHA3-384 hash: 6c00212fccb84f6d985d950808c12d5e31c5d68733601929cdf0e808e86f9b3e9cdc281efe570bc4900589778a79243a
SHA1 hash: 5278c8c1fb4a2752689c81169a895eb061d38bda
MD5 hash: 5c8a054cefa2c826ca3fc7bbd54e58ab
humanhash: echo-ohio-summer-mexico
File name:5c8a054cefa2c826ca3fc7bbd54e58ab.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:335'872 bytes
First seen:2020-05-18 12:20:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3dcb6238fc1bc29ea0e884827788b475 (9 x FormBook)
ssdeep 6144:R722PMfQ2GX5mVRdKantKsghxfVrvE09qpvXDzdkt:R7+QfX5mnnKgj1zzdk
Threatray 5'115 similar samples on MalwareBazaar
TLSH 97646B22AA2CC9B8D53F60B6BAC3CD5A9ECD5DB7202F4C65C538E314D43D6C1C94A276
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Generic.mg.d37ed01b5b4d3f6a.8571.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 09:00:01 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjrjynto4vnug5wahjr6r6kocind756l5t6peliblbivirvjiv7a._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
043ba161ac2f0d30c5a15799d3ce26ec63989d278f58867aeff64ce7ecb41f42
FormBook
0dcc0b25c073c73ae67b48662ec4c81932ff862afdaac7cba1efa63290d6902f
FormBook
27faaaca4acb955010d7b8c16764a536c04149f2d332f99668d6ff6f292bfc20
FormBook
5ad78a69716725c819bc307eb9627bea7479db03cbdc17d5930aa72341fabe73
FormBook
6e67f9295d091f8c9fc762c738712a3516c295b3e22bc8f41465c8633cda5114
FormBook
76d45ff13654988781428940dab2825a158e15679d0f1faf9615b76a2cbff4a7
FormBook
b24a5df4c63722afbed1e3807b18fcc065008ec3431de146dbf3657dffa00893
FormBook
b9862798fc67e4230e1339ab641fbedb31c66fb3cb3eceb27207531246a1a875
FormBook
ce860f3976ba5df3c4465a4b60d12980677dccc961a9fa91555c7b9de14c3dd8
FormBook
f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c
FormBook
+ 5'105 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-8dmlc5d89x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.regulars5.com/ms20/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe 62629c366ee55b4376c03a63e8f94e121a3ff7cbecfcf22d0158515446a9457e

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments