MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b42bb3af52ae6b9fc8dd890fea86abad727db5ae0647217d2f5f2035bc5c2c7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b42bb3af52ae6b9fc8dd890fea86abad727db5ae0647217d2f5f2035bc5c2c7b
SHA3-384 hash: f2f39c419bdc47f236726c1d91978fcbf84219ec070f4ee870c113ea50d905661912276d8e4a4955dcea44d434d81802
SHA1 hash: ba67a674d04716cd610f3366387e7d538e8db351
MD5 hash: 076f6a85bed24ed542e3a154a92fb286
humanhash: minnesota-wolfram-arkansas-spring
File name:b42bb3af52ae6b9fc8dd890fea86abad727db5ae0647217d2f5f2035bc5c2c7b.bin
Download: download sample
Signature Formbook
Create hunting rule
File size:182'784 bytes
First seen:2020-06-10 17:02:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:lQuno/s+ey8MrTc64Mx3uIoZQd6BzMU9SVCzzkDQD8os7RGzJTYSLc9:lQHKwHjluIAfBz39SIzkDv3RGzFpL
Threatray 2'267 similar samples on MalwareBazaar
TLSH 1604BF369642C070F2B251F4B67D1B7B883D0E343295A5E6A3E116E16FE05A9F03A31F
Reporter JAMESWT_WT
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Formbook-7399661-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 17:04:07 UTC
File Type:
PE (Exe)
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wqv3hl2svzvz7sg5reh6vbvlvvzh3nnoazdsc7jpl4qdlpc4fr5q._file
Verdict:
malicious
Similar samples:
0a18c476254735864b8ab07e5223bb310207954cce179c4b773345d73247113f
Formbook
3a65203b683e8f50436aed7a76531617e566c4363ca795885683479e4a3430b6
Formbook
46d500e1f512e941b4c282d92908fb244439bede7a604381f761823d66f8ba2f
Formbook
6f827b68129d30609057c2e6b36be05649fce91d6bc8ee3d3566ca5c6aba562b
Formbook
a658844624b4f1c5dd792ba527d7f04945aac9be928febf34813b3028deaf0da
Formbook
b1809788389e6fbab24abc12b306b2cd4d88a59b983b5a469a63d923e572fa6b
Formbook
cd120b25b52e7720424139783c7b18f496b07f5bd8f3d4c52ea8b149318da5de
Formbook
d571629d266c5354146cdfe698d79c88c33e598aa6c8d9a0587662c6b5421ed2
Formbook
f62545db6d573b7145c40ce57f9d85eafaa9ffd95923178d29a02845def94b0c
Formbook
feb3b84e0ea9e1c3522e9a3258f8578ffe461a43ce41920d6b41fa19520ac7a2
Formbook
+ 2'257 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat
Link:
https://tria.ge/reports/201109-431a83zb82/
Behaviour
Suspicious behavior: EnumeratesProcesses
Malware Config
C2 Extraction:
http://www.spatren.com/k0f/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments