MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e
SHA3-384 hash: de891539dec79ac666985e8b9cb834a402e9eb96505a18a1ea1fae1f4cdd31d3baab3fe83d0d4689678206aef651dd7d
SHA1 hash: 5bb99b9d599a98bc4ce5098ee001410fa8744bb5
MD5 hash: 535f4c641a8bfdc5ab25133a0262479b
humanhash: autumn-oven-hydrogen-utah
File name:SWIFT COPY.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'318'912 bytes
First seen:2026-02-10 21:52:50 UTC
Last seen:2026-02-10 22:25:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'818 x AgentTesla, 19'742 x Formbook, 12'286 x SnakeKeylogger)
ssdeep 24576:LguQDpxJqlGAYbVc5w75BECYyf18yU7PQZATZZRsrwVict:UuuJqxyVc5w7b1Yyf18TDQZAVzsMQc
Threatray 2'690 similar samples on MalwareBazaar
TLSH T122552218365CCF11C5B45BF51472C3385BB8CE66A823D30BAEED9DFB7A5AB062419342
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
162
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/88c54bae-0973-4670-b8a1-51559030ff9a/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
RE_ PROFOMA INVOICE__ SWIFT COPY.eml
Verdict:
Malicious activity
Analysis date:
2026-02-10 13:58:52 UTC
Tags:
attachments attc-arch arch-exec susp-lnk stealer formbook xloader
Link:
https://app.any.run/tasks/72355958-27b3-45de-abf6-7824e42df87a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/52949/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698ba8cbd255592b7e32bdfb
Tags:
autorun shell micro sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt obfuscated packed
Link:
https://www.filescan.io/uploads/698ba8ca981ff1d38a50814f/reports/bea01b27-a149-4be5-9cfb-012ae8481dba/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-10T03:12:00Z UTC
Last seen:
2026-02-12T12:35:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Backdoor.Agent.HTTP.C&C Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Agent.sb VHO:Trojan-PSW.Win32.Convagent.gen Trojan-Spy.Win32.Noon.sb Trojan-Spy.Noon.HTTP.ServerRequest HEUR:Trojan.MSIL.Crypt.gen Trojan.MSIL.Crypt.sb HEUR:Trojan.WinLNK.Powecod.e
Link:
https://opentip.kaspersky.com/5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/03373025-4d28-48c7-938b-f06240dcedd6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.37 Win 32 Exe x86
Link:
https://app.malva.re/file/535f4c641a8bfdc5ab25133a0262479b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2026-02-10 06:23:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kuywktuexcr54phbaqr5cics6bw3ndrhqbpyosq4ifblyj5qun7a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
351d3d2274389081c215d37dd5ac36e03594eb42123afb49fa5447e60f8156bd
Formbook
479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
Formbook
99e787914a65e928c023070c9a029cf58d4e405e4952bbb1142b1c8e53edfcc6
Formbook
ac36e1a80e5bce46ba7b0810ee10075cb7fd7c8f0e2603048a8a1e6f0adc7266
Formbook
b32d05c6d0606ae99980ac52e9acbae681e7c35936abca1aa7bbc66bc25bb0e5
Formbook
cb6107c4531b230c31244db28ca307058384a7ae968e0f0e41991f35a77b2e72
Formbook
e5f1feba5c6cd56201fd5eb64c4d9dbfae827f756ebbfeda3cb51f453d465d1b
Formbook
+ 2'680 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260210-1rpz6sdw2g/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e
MD5 hash:
535f4c641a8bfdc5ab25133a0262479b
SHA1 hash:
5bb99b9d599a98bc4ce5098ee001410fa8744bb5
Link:
https://www.unpac.me/results/9f5b17be-b38a-48b7-80ec-cffaf4c6c839/
SH256 hash:
724245ae3fd7d1632d6e059ad6b79ef92dec9148c6727f9779e8b23800f06260
MD5 hash:
8fb5863356fd4d1d74697aec919b07f4
SHA1 hash:
967caffb512da12ab9dc106004e2ad6b6809538b
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/9f5b17be-b38a-48b7-80ec-cffaf4c6c839/
Parent samples :
bde515aa510b4c30129ab004d7edaab51539f3170289be077bc2649168ccafa4
24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7
479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e
9e4efb8300d61fa29a18a9169965c531fc547234d3ced0532aa341f899801621
3c23073583bd33a068be551134983e7958884cb7656a4da03d9cc737b262f1ee
c9a7422e9bda1f8e36f23648857c16fe5332be73c474503b6502eccf4d5ed059
e37c838dc5eaa1b302ffbd8721c6a5f52a068e8f78bbec63b19b950462fe6cf8
fc72b3ca2ae3fb65114b8c60e539aec25d8e0383204e7cda9794e8b66d2a098c
9843f5987f4cc3ecb4dc341853be6549567da44e273162a36841020464cd9258
SH256 hash:
487e86b78f3929a99cc8e0dae0c7e60d9bfedae0f987361ab60010e6967f9e95
MD5 hash:
3650be3b89d638cc4ab1c20492e3a050
SHA1 hash:
e2f29cfa4512d5a414b261f4e2519622685d3ca7
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9f5b17be-b38a-48b7-80ec-cffaf4c6c839/
SH256 hash:
34265b21d08db558cef3273edd46e78f5aef684b6da22c208e9d44c48f284918
MD5 hash:
239434cc0b1ad3e68938a8885552d26a
SHA1 hash:
ed54ac5753c012bf39e949e5eabb233b0bc55f7a
Link:
https://www.unpac.me/results/9f5b17be-b38a-48b7-80ec-cffaf4c6c839/
SH256 hash:
4850f9fee85436ebb5fe318320f8bb7a1727f1911f11515570521abe1991761e
MD5 hash:
dfc25f2f6ae2187721b2ebec76587852
SHA1 hash:
4eb8e8d247de7a761c54dbe5aba5f3bbbc3a25d5
Link:
https://www.unpac.me/results/9f5b17be-b38a-48b7-80ec-cffaf4c6c839/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5531654e84b8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52949/

Comments