MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb8188f652e39e2517a3281980136d6c45d9003ad3ad2c826c27fc726d6f7028. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb8188f652e39e2517a3281980136d6c45d9003ad3ad2c826c27fc726d6f7028
SHA3-384 hash: 78e1a7d8da60518d6d861775e0e33050252b15dc6122ae4d2c9eab2e4db838666e3acd44c168a870c07d78c06551f61b
SHA1 hash: 1968c2d89bbf9b8b203fa23cdc6d798e463bff08
MD5 hash: f952b2c42ddd25df19afbc2791cb7714
humanhash: foxtrot-blossom-lamp-november
File name:bb8188f652e39e2517a3281980136d6c45d9003ad3ad2c826c27fc726d6f7028
Download: download sample
Signature Formbook
Create hunting rule
File size:911'872 bytes
First seen:2020-11-13 15:22:33 UTC
Last seen:2024-07-24 20:51:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6cea15fcbfd6616496bbe80d9d9d0796 (26 x Loki, 25 x AgentTesla, 10 x ISRStealer)
ssdeep 12288:9kGHOwimf6houmGvFIZhor451w8WucXV8t7mw5j31N7r+9o6YfBBqN8LX:9kJG6houXv4xEXV8tKw5j+nYpg
TLSH 9F158D22ADA04837E4333538C81B5A646F257F712DB4AA862BED3D0F7FB97423415297
Reporter seifreed
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eyqd-9789766-0
Create hunting rule

Win.Dropper.LokiBot-9792233-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Sending a UDP request
Launching cmd.exe command interpreter
DNS request
Sending an HTTP GET request
Creating a window
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb8188f652e39e2517a3281980136d6c45d9003ad3ad2c826c27fc726d6f7028/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:25:18 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xoayr5ss4opckf5dfamyae3nnrc5sab22owszatme76he3lpoaua._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201113-gs13ma9qwj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.gmigroups.com/dn87/
Unpacked files
SH256 hash:
bb8188f652e39e2517a3281980136d6c45d9003ad3ad2c826c27fc726d6f7028
MD5 hash:
f952b2c42ddd25df19afbc2791cb7714
SHA1 hash:
1968c2d89bbf9b8b203fa23cdc6d798e463bff08
Link:
https://www.unpac.me/results/85cb678d-2d3a-46c0-a33e-2925109e7a96/
SH256 hash:
b7394c88e45a6a33a1185c64a53c8d91b5a219362f2709a6afc1e58bd96a393a
MD5 hash:
bae0cd321708d6ee7d2d6364465c0844
SHA1 hash:
b85977ee21850c963575f8072821cfd4f67cbb8f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/85cb678d-2d3a-46c0-a33e-2925109e7a96/
Parent samples :
914b9ec48f15df901f689ee02624b6b164a57ee6dc6383f7770e432f92faa337
9c8e3d4b3014cedaf81092ca9e167bd16ae98e2905e3a7e0ae154b26c387de14
7b289ead031b7f476e07b8637bfb3749554253968060ecdd36046948f6ae5f8e
df9e2ebfb5498c7a938616ded5ac80374743032fde8ef50547e6d49f5fa77098
3ea9584d4931293645529b071a4b0ae494a85638bbb9f0d1083e8dd3cc0ac54f
7a71bafff6bc2410fe174747fa49e15c5560151f2b39f586070d02695fde4c27
15a8b67526b6b563f7fd48850bc4d5fb10e504bb9b2b156c9ce1d82a8a7aaaa7
0ad4a6955fcec7e4768aa5169ad291e3e554e074313bde3ee6c266cddfa2d890
f413624c125a8e6e6e8f4ece883a646fe784bc5a8f4f21185da1df43adc76da1
bb8188f652e39e2517a3281980136d6c45d9003ad3ad2c826c27fc726d6f7028
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bb8188f652e39e2517a3281980136d6c45d9003ad3ad2c826c27fc726d6f7028

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments