MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4adb6a21c1056dafc19fe22df99b061d94e25e258aa4ff3c35fb8cc65faa2c17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4adb6a21c1056dafc19fe22df99b061d94e25e258aa4ff3c35fb8cc65faa2c17
SHA3-384 hash: f87a1faf4e95d620a0692f2e7e11dd7df22db867367fd4019a899aed790b6b5433685a41e11aae28bf74d16dd2844815
SHA1 hash: aff085ccaad6eab712d5f2c51f9a03b1fe70008b
MD5 hash: ea931672906ed9a7913a88440b807dc3
humanhash: tennis-uranus-timing-florida
File name:regasm(4).exe
Download: download sample
Signature FormBook
Create hunting rule
File size:376'316 bytes
First seen:2020-06-23 07:23:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:xPCganNNH/g4H+yyG2sdD2Xt8/fK0zOrA8u0NRZTalGcWWqjlWA7TqwwldWVqfKa:vanHfggDUqQLZTalGH/WA7Vq0JLTW
Threatray 5'007 similar samples on MalwareBazaar
TLSH A984235763A0DE5FD207857103608C3DA6A5B616C1A0AE0F9F9D2B4DBCFA2521F1F29C
Reporter oppimaniac
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12906/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4adb6a21c1056dafc19fe22df99b061d94e25e258aa4ff3c35fb8cc65faa2c17/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 07:25:04 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlnwuiobavw27qm74iw7tgygdwkoexrfrksp6pbv7ogmmx5kfqlq._file
Verdict:
malicious
Similar samples:
00983a8176276beea115d21fef7919c49b29b96d78dbc2151cc04cc7d8c95b35
FormBook
0c6ef50f134bbd723eddc99d8f9fc78b37e7e2590ec907ce4209075677add6d9
FormBook
1940c74c0c28f1bc9e66ffc90e00094601b5c2f7a68f1a034626ccf4969d54c8
FormBook
3f86f49f3c2e3583c70385971bdba545c85d8f2d66f8923bf446dde88be3afc0
FormBook
4c1fe4c0f5d8d1277036802c83df3e083b31318dfc2c194ce93b7169d7ba6e3d
FormBook
d34f87c6a070f4f73344156c16be7040f2932053aea2868e98b0fa4297113835
FormBook
e5bb61ce7666ce9c2fd0245cb13dbb8368d894a767041677c0749438154433fd
FormBook
e6bdca558fb485e6ac7295d20f868902f2b790bc147fb3ab1e3a6628280d40f3
FormBook
e98090d4d1ad51575355593c7bad1c5481d377ea52c4d726ae5b8ce6b09b4f10
FormBook
e99c6ae5a08e119d151f0c28b6b164d98ca6fd24d1d91b6f57bdf40f3d688c91
FormBook
+ 4'997 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/200624-lep93t7e66/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12906/

Comments