MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9f2f86fdb1d229abc6992957ae4148cd892884aee2a7e420ec7eb79c7e66062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9f2f86fdb1d229abc6992957ae4148cd892884aee2a7e420ec7eb79c7e66062
SHA3-384 hash: 41c5bedf36acfab3ce3a70999d1e21b447cd99fd4b3102870f727f9870ca57a1daaf7553992b20fa868d3accd329f6f1
SHA1 hash: 24d1a9483343b3c9357fbb4db94de291c39d25b0
MD5 hash: c4b925a5e995b5be4994d4f94162aed5
humanhash: west-steak-kentucky-leopard
File name:84df48ce68a4fc5dafcb57ff77ab4c7d.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:172'032 bytes
First seen:2020-04-21 10:49:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:42gxpPLjCrh9+myFZpTjmWrVbY61zwnkCn0dE9fH:QF8+d1jmWBbYFRf
Threatray 4'815 similar samples on MalwareBazaar
TLSH 3FF3AF31D642C431E2B241B5BA7D0B7B883E4D34729564F6E3B519E05FA08A5F52E31F
Reporter abuse_ch
Tags:exe FormBook GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
http://www.dtsay.xyz/pipe/doz.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Win.Malware.Formbook-7399661-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-04-21 11:35:21 UTC
File Type:
PE (Exe)
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5hzpq363durjvpdjskkxvzaurtmjfcck5yvh4qqoy7vxtr7gmbra._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
043ba161ac2f0d30c5a15799d3ce26ec63989d278f58867aeff64ce7ecb41f42
FormBook
223bbe1af0d09289a1ebeddf78e3218fcae28d0a69c291d66fee5fa29337844a
FormBook
322427854deccec94e7331e8d3faa9f2701289b8e2faac322889c5b04d6b8f5e
FormBook
3bd58e3b3fe712e8d7595cfbd576a96251c68a5dac230bd3e778640e8eb817ec
FormBook
5628310c6fe718d77dadbc5c8cb6238faa27942517b590c2a87c07aadca429d6
FormBook
5db7e6a9bc7b775eb44e02266ff814ef0cd77dab54afd5fb3398ae56a5e92917
FormBook
b24a5df4c63722afbed1e3807b18fcc065008ec3431de146dbf3657dffa00893
FormBook
ceec91127018aba0be51981277015baf08e3f0ef6fbd0a5efe5821fa698ba645
FormBook
df34eee3a23ae66bb689bc1911e417cdaa7b51c353dc586bdb3280f86df09b55
FormBook
f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c
FormBook
+ 4'805 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

5a705c9ba9db1c6b9486eae4b8f3db1de6afabd339922d991385e3a710875718

FormBook

Executable exe e9f2f86fdb1d229abc6992957ae4148cd892884aee2a7e420ec7eb79c7e66062

(this sample)

  
Dropped by
MD5 84df48ce68a4fc5dafcb57ff77ab4c7d
  
Dropped by
MD5 6885c483262edd31d3f43b80db659e1e
  
Dropped by
GuLoader
  
Dropped by
SHA256 5a705c9ba9db1c6b9486eae4b8f3db1de6afabd339922d991385e3a710875718
  
Dropped by
SHA256 8d6b4e3662a25c32f6334576bcfc5522294a1d75ccdea17e506a7ed6d274b959
  
URLhaus
https://urlhaus.abuse.ch/url/347744/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments