MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d993cb21ffe5a2b315ceede2a9e021f65fba6df052e1d0a400afba3ba76c17a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d993cb21ffe5a2b315ceede2a9e021f65fba6df052e1d0a400afba3ba76c17a
SHA3-384 hash: 640d90791e1ae62413875d1e208a997ad8a5d18e52fd65307ab5453a517c553de655554eeeb8c01839c916e2159e5543
SHA1 hash: 2aefca3001034e6060c17a0beb5283a92eb38b18
MD5 hash: 5fd9af609fa4e443095cd8e1cfe7f9e3
humanhash: skylark-white-tennessee-ink
File name:order5.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'336'832 bytes
First seen:2020-06-19 12:41:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f074fdcbfed5f17d9663ca342d8d6e7a (6 x FormBook, 1 x NetWire, 1 x RemcosRAT)
ssdeep 24576:Gk2X4/w8+GEHGtVlf4H3k6uyefk4DJwPPhvgYO:GkA7N46uyQbDJwXBg
Threatray 87 similar samples on MalwareBazaar
TLSH 8F551721BDAF9432C012C935CD1EB698D8657E006D175B0E6EE43A8CBE35E8DE81635F
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9555/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader33.55111.15338.10603.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 12:43:05 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jwmtzmq77zncwmk453pcvhqcd5s7xjw7auxb2csabl52hotwyf5a._file
Verdict:
malicious
Similar samples:
06c3086d2a9a4456f1e98b32ce177c455ed82caf13ae4bdc2e402d78f566160c
FormBook
21743550446198801a4e0e26178cf590411632b3dd2ec17ba168ae036f00bbdc
FormBook
4fc5c83ab8d45e9b46bc1ab2a20e653d868e57f357b7f5b4ba433706594bc2ca
FormBook
57c622da3b798d481e8d613d73a03433d385300a2022254f4c46508b7de5a884
FormBook
608a80fead8047545beea311f70ac37dcc5c97fceb2961b9cbea9fb6940dc3eb
FormBook
654dcb8cbaca77d6679523c36f44ea656e39a97ce7e4d6f91b089fe8d54f9787
FormBook
66a0da9856d65f7adf93bafb7454c8b29444f1edfd57b4021a1e0b7d55c499df
FormBook
76f14beec386699e8370a3ea20a6671d7932e48382d46c47ae78b6612cdce4c8
FormBook
c441bca193ad71497180db31fc7e3641935113d929c97f2ffc100ff109c4b7b6
FormBook
c59842c19c1b3f0171b40eebfb3e98ddccc4237edcaaa62990a0881ee1f6f798
FormBook
+ 77 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader
Link:
https://tria.ge/reports/201109-k71jhqee1a/
Behaviour
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe 4d993cb21ffe5a2b315ceede2a9e021f65fba6df052e1d0a400afba3ba76c17a

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/9555/

Comments