MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 451d927ff90f8636631c88e4f9877c0f7210850014594709d84ca6e8909af550. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	451d927ff90f8636631c88e4f9877c0f7210850014594709d84ca6e8909af550
SHA3-384 hash:	bfcd069dcbe24f08e0d7a9d40a1fceec0928a8f7d44ed8d7360e1f536cd9cd080bc5a9bfb66f8c32e70d52d204287d7c
SHA1 hash:	3a0cddffe42950d1e99ae849e123d2b0ffc198f6
MD5 hash:	4270de7636c886870c0024ebf8303bba
humanhash:	whiskey-california-two-lake
File name:	4270de7636c886870c0024ebf8303bba.exe
Download:	download sample
Signature	FormBook Create hunting rule
File size:	399'435 bytes
First seen:	2020-07-06 07:12:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep	12288:Bany2D0w1XXX5+mAcptN70aUIRbNzvaec4Z/7gcD:onN5TneIRZzvaenZke
Threatray	583 similar samples on MalwareBazaar
TLSH	3C8412560BA7FCB7E417533505BB56962AE0AE0D2134774B37903EAAB533CA39B1F012
Reporter	abuse_ch
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/21071/

Detection(s):

PUA.Win.Downloader.Soft32downloader-6691270-0

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Creating a file in the %AppData% subdirectories

Launching a process

Launching cmd.exe command interpreter

Reading critical registry keys

Setting browser functions hooks

Stealing user critical data

Unauthorized injection to a system process

Unauthorized injection to a browser process

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/451d927ff90f8636631c88e4f9877c0f7210850014594709d84ca6e8909af550/

Threat name:

Win32.Trojan.Swotter

Status:

Malicious

First seen:

2020-07-06 07:14:06 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=iuoze77zb6ddmyy4rdsptb34b5zbbbiacrmuocoyjstoree26via._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200706-sk8pdg2jya/

Behaviour

NSIS installer

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator