MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba3486ddcb815a5bfae81495f4f48576968b3d6de9f42e0d4358824d7ee583bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba3486ddcb815a5bfae81495f4f48576968b3d6de9f42e0d4358824d7ee583bd
SHA3-384 hash: 158a5a1e72c42da9045df1ab6c5c159fa6c285d0ac859d019c3ac0fe9da41758e7b2e2feaa83e02a7a91149fdd50155b
SHA1 hash: d11eb6f90802fc216a0677654945c64c2b8ec73f
MD5 hash: 85beabc80ea9e81cb3bd69f6397c46dc
humanhash: north-hydrogen-kitten-kilo
File name:85beabc80ea9e81cb3bd69f6397c46dc.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:865'280 bytes
First seen:2020-05-13 11:23:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f63caebe1e46d29542ea606034a7da47 (7 x AgentTesla, 4 x Loki, 3 x HawkEye)
ssdeep 12288:hJ5R1LHd4GYPKElaRQEYrvWwvStl1cCrYQqNaBLtgZoRa/MeaKl4vfbc9r:hzfHZjEuYv0l1zrSQ4oRqzadE
Threatray 5'626 similar samples on MalwareBazaar
TLSH 2405AF22F1D08F37C1731A3C9D1B56A4993ABE1039F85A472BE91C4C5F39792393A297
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.W32.Trojan3.APDS.16897.29180.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 11:37:16 UTC
File Type:
PE (Exe)
Extracted files:
293
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xi2inxolqfnfx6xicsk7j5efo2liwpln5h2c4dkdlcbe27xfqo6q._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0098bf2ef8230d9bb30b451868272ffb271fe63a8c248bfc9ce569991c19f279
Formbook
0a0ac8e138fdddc9e18357375ff41da88e340ac4dfc225d2d60976607dac8d8c
Formbook
1f577a72bdda8e2504e3ab0094e129efe0c8348489c5c4baf9beae2fa5cecaec
Formbook
29247c960e16e376148704241453b7a008a62c050e9d11b2bba111452acb7fa3
Formbook
474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f
Formbook
4e0e1ee117544cc9cb6784d36db3d349624ef1c888267b1e266a03ddb17d33a1
Formbook
8b04dcca28022f6065a0aab229d6fb466ae313dc5dda21b0a7222225d0facfd5
Formbook
969f79907e45ccfccd7ea0072ae993c93b963d0208a971ef24e7b07060300de1
Formbook
e13acda03eb4829793beb5c0664d5752663b7ef5ae72b63724e7eaf189a9fec4
Formbook
efaa9091d5aa1f64ae3b3c1258e90d5bb346e25e75ae3c4530ea9346380e2158
Formbook
+ 5'616 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-8x6w15dt52/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.regulars5.com/gre2/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe ba3486ddcb815a5bfae81495f4f48576968b3d6de9f42e0d4358824d7ee583bd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/362025/
  
Delivery method
Distributed via web download

Comments