MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0df0fba55e01353a9b0adf985e2cc625ba6741d0375e872ea012f99e5dc1f1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0df0fba55e01353a9b0adf985e2cc625ba6741d0375e872ea012f99e5dc1f1b
SHA3-384 hash: c2d0b6fb221b627dc5f32c3d0b507b37b3d4ac9c748f9414d16df1f665ccd136499f052ebf3b8deae497cadc3435e36d
SHA1 hash: 0dd5b29a5b35bd2b08e94e98fef55c4276954d2d
MD5 hash: 9b7874ff2e064b5a65f72a2b07e716cc
humanhash: magazine-mars-leopard-hydrogen
File name:Dco2.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:531'968 bytes
First seen:2020-06-12 06:42:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:pq4ULmva6JiEV8SmfS0pKxbUjG+PY3nbb2KyaC2KQZ7rOuLyGMpn:pBiG8Sm648bUasY3bb2KykCl
Threatray 60 similar samples on MalwareBazaar
TLSH 5DB4F6B3D71CC9E1DDA516F4611E8EA70B502F9F90D4A3D918ECB4BBC779221E0E0986
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9106/
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:44:10 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4dpq7osv4ajvhknqvx4ylywmmjn2m5a5an26q4xkaexztzo4d4nq._file
Verdict:
malicious
Similar samples:
0fca6f4fa44279707d8baca71d47f79687c62f528d0e872dc27c393e15567904
FormBook
15c86f03a9ef0aa9720a510fd21972a675d15c40ad3efbf52ff2e5cc9bb86c57
FormBook
58691961ce7be790966ab5f9b3e9e9740af77b78a36209c8bcd6c229bb1563bf
FormBook
5b775ccff09e5e183a237343bbc0b6057af38838c0781d7927ac5aa686d2e56b
FormBook
7c3289cdc59a8cf32feac66069d09c48a930d4665f740968521adaf870172644
FormBook
7fab681c57b3f8918c974e5a436b72f9a963ae8b4d4ab5592ceb17cdb57f14f9
FormBook
8b821e88c568d00613f802e79eda4c77913a09c7760dcfdd80e8886b0a8bd8f1
FormBook
9e1eb0470f3d916a2f5d92b6cd45bb504284c2e53f26d443a5c54ad1252c4d1d
FormBook
ec8d87e7db1c4f69358cdd9de92c9f8d4077dc7b61b4ccb834bf2fe129279289
FormBook
ffd1bee2a8fd62e3d445c7ceecebe9f615edcfaae2c4743e765e89a1570b51ad
FormBook
+ 50 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-gv3fehef1j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.hearxy.com/s5l/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9106/

Comments