MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 086616679314c8f75f9fa03cc722a56008166c8e9c8a63a653ed45d35628fdf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 086616679314c8f75f9fa03cc722a56008166c8e9c8a63a653ed45d35628fdf4
SHA3-384 hash: b545451aa8c47191dda8c4e5fdb7cd429d0bda33df5de17b2b24e07e5ce837792a0d2ee0a90a09083d77a62e517669fb
SHA1 hash: 2136d23ada2a3b0516232af52b099cdee57e24c8
MD5 hash: 1b1c0c52aa4ea5794cce1dbce13ff573
humanhash: oregon-london-dakota-hotel
File name:REVISED NEW PURCHASE ORDER.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:366'782 bytes
First seen:2020-07-01 14:40:00 UTC
Last seen:2020-07-02 01:48:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e9c0657252137ac61c1eeeba4c021000 (53 x GuLoader, 26 x RedLineStealer, 17 x AgentTesla)
ssdeep 6144:R6dFLEHAElt4U6cgV529rcke7dgdsZ7vEoQrX1yotGVre+LRWEYJBa0TDYkDO36q:2tynq5es7dgdsZgoQbEoEV9WdJBrDYkO
Threatray 5'305 similar samples on MalwareBazaar
TLSH 5B741227BB52F467F48244B08EB76B2AB3B1321156113A8F5BD06E7DAC67AC5CC1D213
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
4
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/17688/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.43030161.1771.14598.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/086616679314c8f75f9fa03cc722a56008166c8e9c8a63a653ed45d35628fdf4/
Threat name:
Win32.Ransomware.MyxaH
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 14:41:03 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbtbmz4tctepox47ua6moivfmaebm3eotsfghjst5vc5gvri7x2a._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
0e661b488a5571afb39ddf31bda089f7c032ed0a077501c3b7c8a31a0a6442d6
FormBook
0fd1ddf542f9746a9e25ceb976d416b8385d837d5e71bb02bd9b999083620d9f
FormBook
52ea3c1f51eb3a8920e2895ebe7d54ed9b010407775434da9c47fdeceae7af84
FormBook
60952b7b0b3edeb47b07f1d2a0fb87856b165550e47c605c4ef4fb1da699a332
FormBook
7f6ab9c1ee0cee3b51e076a98ad0b05416e87de438d475a8137d80405f75ac24
FormBook
8df5858f489a1dd9f113eda4dbe0aded3fd5a128dd32e991e94c5a2b7623ba64
FormBook
99ae2d3c813970e279188fa1fce92e70ac2ba63c03d2d04fd6f719d4953169c3
FormBook
d4405060b30fab298c2747fc58ec301dfa160be2df3e335a78900fac044a2493
FormBook
db4aad17cb58975d3c42dc37b92e7c8bfdce82da52c5eb6a5e87709cf906a684
FormBook
f69e7749b6798b4c4f258eebbedc77992536cc24bef9d1bf3d68315ad16abcf0
FormBook
+ 5'295 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200701-qfwfbrjhds/
Behaviour
NSIS installer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

ace 1464c43fc96ebdca9e41d78122e0a3e00a386c9fd96efd3acabf08ab32870f26

FormBook

Executable exe 086616679314c8f75f9fa03cc722a56008166c8e9c8a63a653ed45d35628fdf4

(this sample)

  
Dropped by
MD5 c2d7d2edd52ad85c54d5eebe2589e3b0
  
Dropped by
SHA256 1464c43fc96ebdca9e41d78122e0a3e00a386c9fd96efd3acabf08ab32870f26
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/17688/

Comments