MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79048d55f5a4e532509d456b4715b0594d85a28233f94e3f8089cc65d3c3433a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79048d55f5a4e532509d456b4715b0594d85a28233f94e3f8089cc65d3c3433a
SHA3-384 hash: 3282da15c83011bde74cb31da878728478e0cfbd365f58221f970df630f423c9dd4998ab1a9119ae7bcdac6466fc8ec9
SHA1 hash: 223cd6f83b6d1b654ae4e3dd1e8fc2a3ec9cf793
MD5 hash: 6f4eec2786f6be2461ccc0434c6e0343
humanhash: cat-hamper-georgia-sixteen
File name:79048d55f5a4e532509d456b4715b0594d85a28233f94e3f8089cc65d3c3433a
Download: download sample
Signature Formbook
Create hunting rule
File size:377'856 bytes
First seen:2020-11-06 11:33:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 791fddcbea681ee72c72df9a3ca50c58 (1 x Formbook)
ssdeep 6144:UhmMXhNSJIR9r372CYgZRM97/ym1p464n1CR76xKuvRm+mHPTvborAL1BdfN:kXh/3GCZRwDd4JauxK+Rm+mLzcwz
Threatray 2'857 similar samples on MalwareBazaar
TLSH 2D84D07838C3C433C4621A345CA4D6F8892EBE341B6555DBFB443F78AE74AF2851986B
Reporter seifreed
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Running batch commands
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
DNS request
Sending an HTTP GET request
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79048d55f5a4e532509d456b4715b0594d85a28233f94e3f8089cc65d3c3433a/
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Malicious
First seen:
2020-11-01 16:35:55 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=peci2vpvutsteue5ivvuofnqlfgyliucgp4u4p4arhgglu6dim5a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
trickbot
Create hunting rule
Similar samples:
1ce0c7f388fb8db723745beb75cfd8e16e6b08ed35268c405bc203813123d284
Formbook
339505a9dc4fdae3e5a44a6d33230c75d181a8674bead358b8c9012156f4672d
Formbook
8b50a9610f9fe8bce3874969c39932235dc3129a3ed7057a40241b44cbdfa0c5
Formbook
92625b5d11e691107b8aa2e733c1be9fe3677b5a86f03e08f239bf6e0d450885
Formbook
a81417bec9f1772e798040075b9211127cefd65831a1bf582f0f72ce2891cae1
Formbook
ae28aba3d630a1246c0d3675e70237f1289956548f4e24e03a5a19c83579c769
Formbook
c0f902eb625b7628d517c0fc1529dd4fe5954889f81bafb5b6e35c39205c84eb
Formbook
d9959e883e5040a3f0b0eeed42e79f42ef2274dc8d00c3f5c4e4161cd7796708
Formbook
e4badaf86c0f22c6b31c97f661ba5af3f757697e7493c2e750a813173dec2273
Formbook
fd09ea46df289ee19611d096f5281c1e15ee2bc2c54388dd35adfa17837eb038
Formbook
+ 2'847 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201106-v1vs7c7f6x/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
f3aa2006efd64018a589f08995d7cb54623102d6226fc355c92e395ab800c3e4
MD5 hash:
9a951d94e987acdf77502435cf0d2ae3
SHA1 hash:
ad597efd5e58684c0554a26ae3f44b2d448a179c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/141ec530-373e-44d5-b622-3094ebac6fee/
Parent samples :
e4badaf86c0f22c6b31c97f661ba5af3f757697e7493c2e750a813173dec2273
92625b5d11e691107b8aa2e733c1be9fe3677b5a86f03e08f239bf6e0d450885
a81417bec9f1772e798040075b9211127cefd65831a1bf582f0f72ce2891cae1
339505a9dc4fdae3e5a44a6d33230c75d181a8674bead358b8c9012156f4672d
9068a4f87026bf855c28696f3a82fb1fbb6139782ff7de81321a190cac8699d8
fd09ea46df289ee19611d096f5281c1e15ee2bc2c54388dd35adfa17837eb038
8b50a9610f9fe8bce3874969c39932235dc3129a3ed7057a40241b44cbdfa0c5
1ce0c7f388fb8db723745beb75cfd8e16e6b08ed35268c405bc203813123d284
c0f902eb625b7628d517c0fc1529dd4fe5954889f81bafb5b6e35c39205c84eb
97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
79048d55f5a4e532509d456b4715b0594d85a28233f94e3f8089cc65d3c3433a
89b648edb009f749c51c6ca2cfc0b2d2f9028250fa1a8f4426c257b613bc5b3d
4cb0a9cadfa57ca281f8d3ea45085fcfe0682f2bfc6c184d192a05d983269004
75c60107da2c67db916e08dfb16787952af14793798bb19e7549f9b0594a27db
b2260553dae0af6a870e780fcaa1330376b9373e85a27c69c17071bfd09ddb88
SH256 hash:
79048d55f5a4e532509d456b4715b0594d85a28233f94e3f8089cc65d3c3433a
MD5 hash:
6f4eec2786f6be2461ccc0434c6e0343
SHA1 hash:
223cd6f83b6d1b654ae4e3dd1e8fc2a3ec9cf793
Link:
https://www.unpac.me/results/141ec530-373e-44d5-b622-3094ebac6fee/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments