MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 010adbf57a754d053fc6c5cdc79cfe1d86373b2641a60eaec7b9868f34124bc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 11

Intelligence 11 IOCs YARA 14 File information Comments

SHA256 hash:	010adbf57a754d053fc6c5cdc79cfe1d86373b2641a60eaec7b9868f34124bc9
SHA3-384 hash:	8c9b848910fbd94b460a1571578c0c44ff9caed37329e9cb71e3ee4c5ebb77e93ef8a65f855f5e419114af9823eceab5
SHA1 hash:	0b6d514b1a1bdd860ea90edbfa824e321db94ae0
MD5 hash:	6d8d89cbbeeea97e08de9ebeae8b1120
humanhash:	illinois-floor-venus-stairway
File name:	PHOTOS 08-21.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	765'768 bytes
First seen:	2025-08-25 08:39:09 UTC
Last seen:	2025-08-25 09:21:54 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:9NGl17lqyy2tvJuA99rL4nlrBdt4azrW0XYkOH2yZw6FxqKCQYjFnX5smK7p:9OlqU9oisnlrZ4Iayqq6C9nX5Bip
TLSH	T1C2F43309C97753CD3D0764BAFA6E1B49028EBFD2C48A7381BDB952BB6E71590032C197
Magika	zip
Reporter	cocaman
Tags:	FormBook zip

cocaman

Malicious email (T1566.001)
From: "Sandeep Vig <accounting@kgboffshore.com>" (likely spoofed)
Received: "from goofy-sutherland.78-159-131-166.plesk.page (unknown [78.159.131.166]) "
Date: "21 Aug 2025 23:33:08 -0700"
Subject: "PHOTOS REMOVED - 08-21"
Attachment: "PHOTOS 08-21.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PHOTOS 08-21.exe
File size:	1'219'072 bytes
SHA256 hash:	1671e2668783d7c256806afc89fe60355c915cc163d7e8a31272636bd16cc34c
MD5 hash:	a096be0ab40066b7c7c633035c4098fe
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ac21516eed937d746dae4d

Tags:

nymeria autoit emotet

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/010adbf57a754d053fc6c5cdc79cfe1d86373b2641a60eaec7b9868f34124bc9/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script evasive fingerprint keylogger lolbin microsoft_visual_cc nymeria packed reg threat

Link:

https://www.filescan.io/uploads/68ac21557137d684583b14ec/reports/6aa4ef18-6f9f-411e-8d3b-79a668f5629e/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/010adbf57a754d053fc6c5cdc79cfe1d86373b2641a60eaec7b9868f34124bc9

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/010adbf57a754d053fc6c5cdc79cfe1d86373b2641a60eaec7b9868f34124bc9

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

File Type:

zip

First seen:

2025-08-22T05:25:00Z UTC

Last seen:

2025-08-22T05:25:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/010adbf57a754d053fc6c5cdc79cfe1d86373b2641a60eaec7b9868f34124bc9/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook adware discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/250825-mn992svrt4/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/010adbf57a754d053fc6c5cdc79cfe1d86373b2641a60eaec7b9868f34124bc9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)