MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3b093d992d26b0d21a61a778598abd5dd87649a89f724c2798f60f9dc19de1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3b093d992d26b0d21a61a778598abd5dd87649a89f724c2798f60f9dc19de1a
SHA3-384 hash: 48197ba1eb0be8759dfbc2b146de885e1a3620ef588db03848eeec450b0fa93f6c76b9338db91a6dbd270397759a5178
SHA1 hash: b742ec23d39e87d5f1cfc2d14825fef96e794488
MD5 hash: 6f4f56c41c9c6e3bbe4ecba33b37b6e7
humanhash: kansas-michigan-eighteen-jupiter
File name:6f4f56c41c9c6e3bbe4ecba33b37b6e7.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:675'328 bytes
First seen:2020-07-02 07:55:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 86cb21fe3fc32c3cf920f8a12457a1ce (12 x AgentTesla, 11 x Loki, 4 x FormBook)
ssdeep 12288:7kjUKvv3jOGU6mLXDvJiw7s2jAXuDtzwF/O+ZQ2fl+Pwa:AwKvrOl6m/0mfA+xUB7XlGw
Threatray 5'323 similar samples on MalwareBazaar
TLSH 49E4AE32E2B14433C1631A7C4D5B5678A83ABE103925A8762BF7DD4CDF39781396B293
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/18389/
Detection(s):
Win.Malware.Fareit-6863179-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b3b093d992d26b0d21a61a778598abd5dd87649a89f724c2798f60f9dc19de1a/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 07:32:25 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=woyjhwms2jvq2ingdj3ylgfl2xoyoze2rh3sjqtzr5qptxaz3yna._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0098bf2ef8230d9bb30b451868272ffb271fe63a8c248bfc9ce569991c19f279
FormBook
08b47c6d183afb72f383ced4639ba73a03d9b36f06617585b3a3d28b69d1ce9f
FormBook
154abcf7b4d3b8ff3395661ee7a03dc8e473f9dc3fb51386a1c49d881bc62387
FormBook
1cc899a5fc4a3e7fe1c9d1265b60a4faf51bc1df3e4b25c088979755410fa954
FormBook
4adb6a21c1056dafc19fe22df99b061d94e25e258aa4ff3c35fb8cc65faa2c17
FormBook
8606768cb758ba8379659f65220250ebc1c491dabd668e7f98663571419cadf2
FormBook
9c0d3c463792d704909de3a04cd7a6d31f8094301e8e24950af31cdc5e9f2838
FormBook
b1ab330d8407adbc0731fd66b869bca53515ccf732d1ad498515e5e04f993de4
FormBook
b9cd83c667b694ec10f884183b138beeb0f986a7d3c50af463535852f2fa0663
FormBook
c46f6d72a258354c5267436ea0db9cd3f12cc1595a0d9072d904b0b15731f092
FormBook
+ 5'313 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200702-fdlsd6kat6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe b3b093d992d26b0d21a61a778598abd5dd87649a89f724c2798f60f9dc19de1a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/406963/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/18389/

Comments