MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb79e22a86732bd8ccbb3d73dcc9ef716e305c85dfed8872851c273d1eaacaf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb79e22a86732bd8ccbb3d73dcc9ef716e305c85dfed8872851c273d1eaacaf4
SHA3-384 hash: 23e716ca0cc0ef14ef8c619552f7e8ab5603d8437e886366a82a51136b8107719c2a0056c36aae9730482ad818611274
SHA1 hash: 7d841c518c0511f4eedeb199a90a77dbdd7afe6b
MD5 hash: f5a5f90a4ff053b39c6a9858f0fbabe9
humanhash: london-potato-freddie-arkansas
File name:a60b438de31f114880eec56a2d130c03.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:172'032 bytes
First seen:2020-03-26 15:38:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:9Ec59W7P2DoMFCeFh6z2TZB+PT6kZmi0DhbOhpgh+6N9WuUBtfn:q2WCYoM6nOT6kZ41KhC++WuUBtf
Threatray 4'841 similar samples on MalwareBazaar
TLSH 75F3AE71DA41C035E2B201B5FA7D077B883E0E387695A4F6E3A116E06FA44A5F52E31F
Reporter abuse_ch
Tags:exe FormBook GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1XKY3heaitIMYV-CFRnF0Izspxyew8J36

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Win.Malware.Formbook-7399661-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 16:37:05 UTC
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zn46ekugomv5rtf3hvz5zsppofxdaxef37wyq4ufdqtt2hvkzl2a._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
043ba161ac2f0d30c5a15799d3ce26ec63989d278f58867aeff64ce7ecb41f42
FormBook
223bbe1af0d09289a1ebeddf78e3218fcae28d0a69c291d66fee5fa29337844a
FormBook
27faaaca4acb955010d7b8c16764a536c04149f2d332f99668d6ff6f292bfc20
FormBook
3bd58e3b3fe712e8d7595cfbd576a96251c68a5dac230bd3e778640e8eb817ec
FormBook
3c11c15902d64e4b5ad06df07af329cb59a9626dae68a25fc9fc87dd4db9e6a2
FormBook
590fde182a154cd89b15d88546d60351b9fecb51e04fbbf4affd8d49a618bd23
FormBook
7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6
FormBook
a91c5af7a94238bb1556b641b9f5bc7798133b3d699a9f3d5b88b8f8fc12f091
FormBook
b24a5df4c63722afbed1e3807b18fcc065008ec3431de146dbf3657dffa00893
FormBook
f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c
FormBook
+ 4'831 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

2fa43bb43af8b2f004bbf5555407ad66df82da2b6de6ca964b990057fcdd2b95

FormBook

Executable exe cb79e22a86732bd8ccbb3d73dcc9ef716e305c85dfed8872851c273d1eaacaf4

(this sample)

  
Dropped by
MD5 a60b438de31f114880eec56a2d130c03
  
Dropped by
MD5 2071d5bd2f5b1d3aada3496bc35176af
  
Dropped by
GuLoader
  
Dropped by
SHA256 2fa43bb43af8b2f004bbf5555407ad66df82da2b6de6ca964b990057fcdd2b95
  
Dropped by
SHA256 c7e45a3816b91e1b29cfaff41d93b9cccf0f61f238da0b6a419eb993a8a1acc7
  
URLhaus
https://urlhaus.abuse.ch/url/328880/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments