MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 157ef05047452109ec1552af00806f1469254bc14a5cc942e41180ee82d508a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 157ef05047452109ec1552af00806f1469254bc14a5cc942e41180ee82d508a7
SHA3-384 hash: 1d9547fa51b9b67fcfab46a951041fccd701abd9a3c322db32104eba0d4fd455eabc5cf65effa95c04310266e0b16dc1
SHA1 hash: 24663e90dc8591a9e31b62f6098e2afb25ca43d9
MD5 hash: da6019826aa0676f5d0fac5afce23ff3
humanhash: triple-zulu-hawaii-india
File name:e6891d6d6c050503475705e0499f06c3.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:171'520 bytes
First seen:2020-04-07 05:45:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:Z3qe+OPzZFiUkYYK/wxBvTbxEmrEk+ESWU/uqalSDcsSZ6tGlNEgqgmt:s+sYDIx9TbxEzk+EvS5kacsSQtGlyt
Threatray 2'256 similar samples on MalwareBazaar
TLSH A7F3AE36EA41C031E2B241B5F67D0B7B883E4D34329564E6E3A526A16FB08D5F52E31F
Reporter abuse_ch
Tags:exe FormBook GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1ikX_CBWDrGqwrqQA7EU9VgIGqmy8aXOJ

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Win.Malware.Formbook-7399661-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-04-07 06:36:00 UTC
File Type:
PE (Exe)
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cv7pauchiuqqt3avkkxqbadpcrusks6bjjomsqxecgao5awvbctq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
11892c93ce6ecc668a92bcbb2e618edbc40f87cea8938e2dbe7061cbc6d1f689
FormBook
1b7e04d537fb0ed215cf1d0d4445def97cae4701c1c889f4e94736e1814d9233
FormBook
1d1c9ee0b1adaa5a121fd70d332785395ad22538f9cdc7db44414c1604e28919
FormBook
1e1a825c158fefa17df9237a4be60bc99e1a2a42ded631c8636b6af668b1627f
FormBook
30bbf2043054b92e495bbd55f67e43b8eafce430bf31d8aaa4899385e503cdbe
FormBook
3527457b184139953c43be59287281eb8f797e9cc8f3e9d637362276fe4f83a2
FormBook
58f28dd7cc2c257f5ac8dec9111d8cf8942e1cf62bb8334f4922e4b124d4eab9
FormBook
8df71043e89088e65c08e918cdd0d0278e78ce39d3d22e04e0310c3d7ec50b28
FormBook
c28628e453851e95098e1706bb1d130a863b70abd4b5c316ea710f83ef68b0a1
FormBook
f9a4827b1355e83175a1ff06792046f8f81e7140748600743636a7725f9a79c5
FormBook
+ 2'246 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

6c5c199244e4646ce9a6b8808cb2836c1a12e8a00f669d64f1a12f9a553eebb2

FormBook

Executable exe 157ef05047452109ec1552af00806f1469254bc14a5cc942e41180ee82d508a7

(this sample)

  
Dropped by
MD5 e6891d6d6c050503475705e0499f06c3
  
Dropped by
MD5 288c294ebdac20632d5141a58fe317fb
  
Dropped by
GuLoader
  
Dropped by
SHA256 6c5c199244e4646ce9a6b8808cb2836c1a12e8a00f669d64f1a12f9a553eebb2
  
Dropped by
SHA256 f95d1baa9ce04cc9cc1c4d19152eec2a4ffb402558c1228a6f6bbb9ed2d91bbf
  
URLhaus
https://urlhaus.abuse.ch/url/336048/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments