MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36aaa61da7c30d84b06d1a0de81be11faa87266b5b88d45d04476ffc0112e53a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36aaa61da7c30d84b06d1a0de81be11faa87266b5b88d45d04476ffc0112e53a
SHA3-384 hash: 50be03a85eb18ffb679914692633f56f42aa7ac7ce5bbd0060268751aa55989b33e80c9b75cf91012fcfc11168112b52
SHA1 hash: 6a0255e5985c592c6998db3976017296c5b0b3eb
MD5 hash: 96da37af9ba76bab17ed9b223cff97e8
humanhash: skylark-sink-edward-burger
File name:96da37af9ba76bab17ed9b223cff97e8
Download: download sample
Signature Formbook
Create hunting rule
File size:881'152 bytes
First seen:2020-11-17 11:59:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:vTOSCOwN0+dVuKB8Oirfg99KApYSoUyA85Yx6h44E:dwN0+mePYY99rpYSoUyA8awh7E
Threatray 2'951 similar samples on MalwareBazaar
TLSH A6156A16263C5FEAF5AC2EB680400714ABE59D028A31C456FD9F30E9EBB7F97C1192C5
Reporter seifreed
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Score-7597125-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36aaa61da7c30d84b06d1a0de81be11faa87266b5b88d45d04476ffc0112e53a/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 00:52:16 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g2vkmhnhymgyjmdndig6qg7bd6viojtlloenixiei5x7yais4u5a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
124bbabecb8fc90f529eabfbd3aec4e4604782ca267c954ecf9cf38f48b43aa4
Formbook
19427e067d1a9b655253eaaecce802bcbf6a822a1a52a32ab4a227968054d116
Formbook
200f07a68b2fb323fa7f8cfa944a5bed193adfedcc00570a238fd66662109bd2
Formbook
2128551c6363325c0d054a9a4d19bd066a9bde70d6ee860535d298d6961b54d7
Formbook
3dc50d4418b7d64dcbb6c364e49b19cf8bc06ed7d2cc6566658ab3bac8a8c347
Formbook
5120376bed226fac5d8eb936eb1f798fc4f7f51e263e40a2e9b16fcb949eb6e2
Formbook
7315a2ebbb0bb585763c14e7c9f83722816d908e62407725e0aeb4f3b7d2ff5d
Formbook
797dd6c7fd666d180638505d42d8803dffa37e8b76104fe77b21a680524242e7
Formbook
afbb4d08bfde470b3405f98f84a5be0456cf40edf8f08f7b4cb7a6cfcf5ee682
Formbook
b868ded573176e58f1d498447a375a73ff901fe072c28af6be9f851f8d0cdacc
Formbook
+ 2'941 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201117-p5lt1qzke2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.outtheframecustoms.com/9t6k/
Unpacked files
SH256 hash:
36aaa61da7c30d84b06d1a0de81be11faa87266b5b88d45d04476ffc0112e53a
MD5 hash:
96da37af9ba76bab17ed9b223cff97e8
SHA1 hash:
6a0255e5985c592c6998db3976017296c5b0b3eb
Link:
https://www.unpac.me/results/710cf342-7f8b-4bf8-b489-824d092e56d5/
SH256 hash:
df909b5e8ac32a37af132b3de6322bbadee81d4123182e09c7892a1005f16842
MD5 hash:
92df09e24b89b3e6eb221b550a3d757d
SHA1 hash:
1cdf032adcf11a616d8e513838ba50ec2ae86df0
Link:
https://www.unpac.me/results/710cf342-7f8b-4bf8-b489-824d092e56d5/
SH256 hash:
9aa99ac78810cd2a7a948caac96c7b37baab7fad407527f0ae875b64e15019ca
MD5 hash:
43df5cedf1ea813c57485cf6fb33fa72
SHA1 hash:
47a1a7ba7decf8246b632168d5cbdda1b58a01d8
Link:
https://www.unpac.me/results/710cf342-7f8b-4bf8-b489-824d092e56d5/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/710cf342-7f8b-4bf8-b489-824d092e56d5/
SH256 hash:
2675bc7b7bd9dc81e47de36455e479e09a116dfe0a70b1644f53422c90989a9a
MD5 hash:
162fde8f3d5c40936bd33952bf3e00fb
SHA1 hash:
a7cae18ece9b7c539ff1522700b2e4eb77cd494f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/710cf342-7f8b-4bf8-b489-824d092e56d5/
Parent samples :
7315a2ebbb0bb585763c14e7c9f83722816d908e62407725e0aeb4f3b7d2ff5d
200f07a68b2fb323fa7f8cfa944a5bed193adfedcc00570a238fd66662109bd2
fe0ac8413830a780c0b21a9d453354d61a7ca21f08cadc5e40ba672e7d87d96e
36aaa61da7c30d84b06d1a0de81be11faa87266b5b88d45d04476ffc0112e53a
8e9bc8937b7c4448c8302e1e2b03af0e9fac285df0d8615e01e0e383694178b1
ae8f3d13092dbd9ac0a490c691eefafe0026e44148a9df896d6b5b8edceb5284
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments