MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c3dd49a5833197c8ded3093df9fa770129e196acf76de5a54ae3ae3e9580cb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c3dd49a5833197c8ded3093df9fa770129e196acf76de5a54ae3ae3e9580cb8
SHA3-384 hash: d951b8ada5fa5356b60e4a793b0a6e6ca0d4a0095a550cae80f7340015bdc6937c97768d3840de65519c76a898a1b4b7
SHA1 hash: a8c85dc7622eab0ca08b2f98a6565f13a21c790c
MD5 hash: eb5b485e0555135df5a7ba3beae0f9dd
humanhash: triple-glucose-seven-chicken
File name:eb5b485e0555135df5a7ba3beae0f9dd.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:328'192 bytes
First seen:2020-05-26 10:00:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 489dac1a8118893ec872ada929df1c44 (3 x FormBook)
ssdeep 6144:o/jQSLo7aMDMeO/WQ044ljm4iukkLtGCv5HCAXDzdkD:ubLotDMeO/Wfm4fkk5fB1zzdkD
Threatray 5'264 similar samples on MalwareBazaar
TLSH 7864AF62FA5CD5BCD63F50797DC38DF68DC605A3406F8CA6D928C606C8ACB818997237
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 03:16:58 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
08b47c6d183afb72f383ced4639ba73a03d9b36f06617585b3a3d28b69d1ce9f
Formbook
16de0aa2d02fae6460bb173c9104df4fa758343ab226aea79a3910dce19fa58e
Formbook
5ea463243b051351c219469515fb9b39d01c5c3c4f4698bd6164e36070622d35
Formbook
783c6835be34af1803983890ec14e1edb2ac7cef4442dff43cddb719d97236b2
Formbook
79aeb20e06ed62c3986034328cd3a6a5e08eb617cba4af679112640f786497da
Formbook
ada94346c3ea30c0fce4f35e075d45ca022923d8afc8c93c4895b5b05591a857
Formbook
b3b093d992d26b0d21a61a778598abd5dd87649a89f724c2798f60f9dc19de1a
Formbook
bf04f6a3d759b9ce48f004cc8667d1b30b97451bcef767932fa6cbdd96ce87e9
Formbook
e3bdb2a06e43b09073cebd4f7a7fe633d45d1c6d149885f7b815cc591fe3b453
Formbook
e6d371badc121f232f4305f3a50f0a136d1b7edbc3337414ca692c26ae41986c
Formbook
+ 5'254 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-fy1kfsv6k2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.tromagy.com/yx5/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 9c3dd49a5833197c8ded3093df9fa770129e196acf76de5a54ae3ae3e9580cb8

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments