MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0aae8246644059c7f7099859255863f5b32bcc04118717f44375928b3cba9add. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	0aae8246644059c7f7099859255863f5b32bcc04118717f44375928b3cba9add
SHA3-384 hash:	22b2858a337d83092ea3481c7a02fb006f4688654e8fc116ee3817c7509b79d95bcc1b80b9b2b23e6835689f398b5be2
SHA1 hash:	4b72570a1fdd5e1cade32730f1440e746b64f12a
MD5 hash:	9e619445c257dcf062bb1791942d3bca
humanhash:	ten-steak-charlie-video
File name:	9e619445c257dcf062bb1791942d3bca.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	2'397'410 bytes
First seen:	2021-08-05 05:58:14 UTC
Last seen:	2021-08-05 07:21:33 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	24576:PuOfaOfaOfaOfCOfWOff0eVfu9RXUp7JIQsqVVEskIWK2OfaOfaOfaOfaOh:Pvu9Rk7JZus1
TLSH	T112B5C1A3F22CB33EE51551B838D59D6E56ACDE3C561EE1062B72329BE420A1C17C0ED7
Reporter	abuse_ch
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

302

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

9e619445c257dcf062bb1791942d3bca.exe

Verdict:

No threats detected

Analysis date:

2021-08-05 05:59:41 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0979e696-dc49-412d-866c-63ad3b1bd2eb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/176523/

Detection(s):

SecuriteInfo.com.Trojan.Siggen14.52598.8907.21540.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/74bab735-c578-4a40-bbf0-2c724ea6b79d

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/827865

Signature

.NET source code contains potential unpacker

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0aae8246644059c7f7099859255863f5b32bcc04118717f44375928b3cba9add/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bkxierteibm4p5yjtbmskwdd6wzsxtaecgdrp5cdowjiwpf2tloq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210805-s6llz5xl8n/

Unpacked files

SH256 hash:

0aae8246644059c7f7099859255863f5b32bcc04118717f44375928b3cba9add

MD5 hash:

9e619445c257dcf062bb1791942d3bca

SHA1 hash:

4b72570a1fdd5e1cade32730f1440e746b64f12a

Link:

https://www.unpac.me/results/520f4ca4-48e0-4a48-b0a4-266884bb441c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/0aae8246644059c7f7099859255863f5b32bcc04118717f44375928b3cba9add

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers