MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f91b7471cdeb5b3ff9ac0fbbef508f16a405631a3d3ec8014d0ad87d5e6fbcd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f91b7471cdeb5b3ff9ac0fbbef508f16a405631a3d3ec8014d0ad87d5e6fbcd5
SHA3-384 hash: 2c9d7e54e279797c69b5dcce694561eeeb4ad0c4efbb9b0dd05f627335dae89144737e85bdd7d85a31c5b44ac4f5e1ce
SHA1 hash: 7901095067aab8e0c400f34343ddf52371671a9a
MD5 hash: 80e034f9519c0b327c5d55c5ba34511e
humanhash: orange-sink-batman-robert
File name:80e034f9519c0b327c5d55c5ba34511e.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'642'496 bytes
First seen:2020-05-18 07:49:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:9Cdxte/80jYLT3U1jfsWag6GBYsY2d9aeHhvms5IcVVczXhoVtIpoAokCJysyEQ:Uw80cTsjkWag6k+eHhtKDbhwEoAoNh8
Threatray 5'093 similar samples on MalwareBazaar
TLSH F575E02273DEC371CB769173BF69B7002EBB38254630B95B2F881D7DA950162162DB63
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 09:11:01 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7enxi4on5nnt76nmb6566uepc2sakyy2hu7mqaknblmh2xtpxtkq._file
Verdict:
malicious
Similar samples:
00983a8176276beea115d21fef7919c49b29b96d78dbc2151cc04cc7d8c95b35
FormBook
059adc86fc6f66c311937e2fd4910fa9d07d55b1897daa608bfb54e01f655257
FormBook
0cd1ca47d2e04de65562e1ba4d8ce4545ee486999f8f0eb7adc880c7fb7fc9b8
FormBook
1a96662a743a681756e4ae5ed7a3d259cca5a50725413698c1769939a950b455
FormBook
2fcab21d4d5863ef934dd19e96379fb5e796b9ae4d77d1d6784bfc25887ffacb
FormBook
72e42f1672249fbd4db20c17d5e29fba5838ef08cf0f6964d84ffc434ea46f27
FormBook
923a8eab7773b5be5e3e380de1505a2c6c71f7b82329e9f3b3ff1461dc057610
FormBook
d7083f1007834bbc16f0b6d2ee0e1e2b9e79a04af2a2e21f2d2682c9dff939eb
FormBook
eca4673c4308cb6dfd3757fcda824d93b7076fa2b2e7b2912863cdc4cb3f422e
FormBook
ef65a30135b6992aaeacde426734212d73f563d0e6cffc59785aae1c495f8491
FormBook
+ 5'083 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan persistence
Link:
https://tria.ge/reports/201109-422cxf6jsj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.glamotd.com/gm1/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments