MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a91c5af7a94238bb1556b641b9f5bc7798133b3d699a9f3d5b88b8f8fc12f091. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a91c5af7a94238bb1556b641b9f5bc7798133b3d699a9f3d5b88b8f8fc12f091
SHA3-384 hash: 9e251d4d4efe5c20d78c4cf01dd2364dcbde8cd27cbf989ce34cc2704ae4587fa23dce7b2ae30f8085f3f11eeeb51065
SHA1 hash: 900ca99b26e5d58c50cfe5e0737e4404bc58e56f
MD5 hash: b542f3dfb6540634bf02e61f090870ab
humanhash: kentucky-diet-tennis-burger
File name:f1760879a742f7f21f434f6e4e68a89f.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:171'520 bytes
First seen:2020-04-09 18:25:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:kBEq0XPxqjRdGAlpAdQM0TYRFshsO8IAZqmUEuUSRH4Dpt/B:iWel6GLTYRFs78GmUEuUSRH4Dp
Threatray 4'914 similar samples on MalwareBazaar
TLSH 1BF3AF72D642C031E27202B5FA7D1B7B883D4E38728565E6E3B025E15EB44E5F92A31F
Reporter abuse_ch
Tags:exe FormBook GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=10Za1uLdaWNix5aO8xGIXTDLdbY5JEGd-

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Win.Malware.Formbook-7399661-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-04-09 18:36:03 UTC
File Type:
PE (Exe)
AV detection:
30 of 30 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=veofv55jii4lwfkwwza3t5n4o6mbgoz5ngnj6pk3rc4pr7as6ciq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
043ba161ac2f0d30c5a15799d3ce26ec63989d278f58867aeff64ce7ecb41f42
FormBook
27faaaca4acb955010d7b8c16764a536c04149f2d332f99668d6ff6f292bfc20
FormBook
322427854deccec94e7331e8d3faa9f2701289b8e2faac322889c5b04d6b8f5e
FormBook
590fde182a154cd89b15d88546d60351b9fecb51e04fbbf4affd8d49a618bd23
FormBook
a0d38e74310877d9ee7a4d0e75e25272adb25199527d19bc08c0f1ebb21f9ce6
FormBook
a85f53a7ad2f536d245e47535007f2bceacfa10f08d7f3f6568781dd1794caa0
FormBook
b24a5df4c63722afbed1e3807b18fcc065008ec3431de146dbf3657dffa00893
FormBook
bf58aecacc268c49d707512236a42c80cf096b24850c3096eb056f662ecbe2e3
FormBook
ceec91127018aba0be51981277015baf08e3f0ef6fbd0a5efe5821fa698ba645
FormBook
f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c
FormBook
+ 4'904 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

58303d7aaf17b8761b463ba4cc78f52f40c2dbd48ce6a832fc3d70ae2e8aa58e

FormBook

Executable exe a91c5af7a94238bb1556b641b9f5bc7798133b3d699a9f3d5b88b8f8fc12f091

(this sample)

  
Dropped by
MD5 f1760879a742f7f21f434f6e4e68a89f
  
Dropped by
MD5 500f7082ec411f665573915588e01218
  
Dropped by
GuLoader
  
Dropped by
SHA256 58303d7aaf17b8761b463ba4cc78f52f40c2dbd48ce6a832fc3d70ae2e8aa58e
  
Dropped by
SHA256 a3e338233ce7055108f2a089bc609495df85fc564536ec1291f3cd7397c2102c
  
URLhaus
https://urlhaus.abuse.ch/url/337974/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments