🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86
SHA3-384 hash: 6d01f865b0e3b5c63a4d347f51b444e0fa6f329da8a0662bc1e174f335b5eda8efec9559e79eabddccc221f16a98da47
SHA1 hash: a9b0d5c998d7986ec552ba5e0d0424621a616062
MD5 hash: 50c1db0291ef22436bd03d28d747ce89
humanhash: sad-may-seventeen-sixteen
File name:056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86
Download: download sample
Signature Formbook
Create hunting rule
File size:1'161'216 bytes
First seen:2026-10-19 07:39:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'359 x AgentTesla, 20'862 x Formbook, 12'418 x SnakeKeylogger)
ssdeep 24576:4Py2gM2WsXj2CEPeiDQuE7Aud80XUFDIg8aRmS2n+4YRNPc:4qvJTjEPesHE7Aw8YUFDRRwS2n7YRC
TLSH T1903501142219CE03C8A64FF40A71E2F41B36AED9E921D2139FF67EEFB9797151518382
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/8dcc6037-093a-4fad-a806-dd3ca512a838/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-19 09:16:31 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/593eb2d5-a2fd-4f3e-a3bd-8884a8baff48

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/92667/
Detection(s):
SecuriteInfo.com.Trojan.Inject7.2544.6327.10516.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad5d20d5a22ac805bd7d9ab
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-01T03:54:00Z UTC
Last seen:
2026-10-21T03:12:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cad5cb5b-9779-47a8-b3c2-1918dc2f95c1
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.31 Win 32 Exe x86
Link:
https://app.malva.re/file/50c1db0291ef22436bd03d28d747ce89
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-10-19 07:40:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=avwpibtd7fap64awlv2ouq4a4evlhv5jfpt4qigjal43z67vz6da._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/d61e4776-7343-43b0-a52d-c686b13d3f8b
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/261019-jhrnzastcx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86
MD5 hash:
50c1db0291ef22436bd03d28d747ce89
SHA1 hash:
a9b0d5c998d7986ec552ba5e0d0424621a616062
Link:
https://www.unpac.me/results/c5518e29-73ee-4f37-a53d-c0e3413325d8/
SH256 hash:
130c9f23a7a5ba673219da983e25d4f427f69fd01c6d25c9a37317fd0c8b5019
MD5 hash:
6bd5946c437973bc849cef0d6d77eaef
SHA1 hash:
009144d539abf4935a22c321879a170362bfa94f
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c5518e29-73ee-4f37-a53d-c0e3413325d8/
Parent samples :
b4b38e1c2c99174f61ed28ee6651e492eb699ccb387433a0cf3861a73967706b
bb0e7d8f68274b32a12a3907fe52d5f1beae19a3ba1bd2c0a23cbbcf57fca2bb
fa40373e5a9d2462d48caca66c22f98e65cebe0fe05f81dce42eae9476526673
97ef870406a1f48080539a324094cdb9eae8f41aeafdc8be86f4c4aaa5a4f14e
09eb32938a0f1265b45c4724b1d994fbc6d2b2ad99f0fab17f545c93e2f42693
5893615f14546d40699d75c7e0691db668da21b4039ea1935376eec550faf9d2
3488ae53d1f63964d4f23dbd6e965dd1fa05c49255ec39be46f677b61bc81c79
dcdde603c0d66e1716ef4c7e8596a11d2818c2151b6c440108ff12f079c3ec7d
4ddba4d5600dc9bb4a88be881700c90ddc3fcd84aa8943c7eacd09a6442a3308
056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86
0317391e6f82d4c482d55f13426771f59af2993b8aa0d1244ecf7df1fb05df13
32a186d26a7797d3c68cfec5edb7dc580dfcc3e71523e26b036a3d8a1815a3be
98f8ae8fa4845bf2d2211182a076027c29d1870cad5ddc150155cdbb72089f1d
49d50307fc575983ad4490d97f535d857a4b1826dd751462d722d22c68b5f8d0
92983d9ec7cbe89ec118ad1757e66954a67912a6332575e8bc65d9b7ad88d4d1
5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3
85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65
ff5bb9669cc476cdb2d6a61e628d475f8839de65661e36704d8c2a569db0fdc3
SH256 hash:
ce2fa2e8402d3cdda00f129368eeb553896c88e4d4441aa2e80f9c97fa04f190
MD5 hash:
d1602e4c552bad5ab0770023dc0d356b
SHA1 hash:
aebff2d763fd3bdd5ca48397afe362b25506f190
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c5518e29-73ee-4f37-a53d-c0e3413325d8/
SH256 hash:
77773802174eb237f819f765ec522bffaff01225a68be1857116cfeb0c1704bb
MD5 hash:
37ff0139d5929450c9d8c0cdbde2ca7b
SHA1 hash:
cbf41319b331bb912cc6317a0d6c227f8317d228
Link:
https://www.unpac.me/results/c5518e29-73ee-4f37-a53d-c0e3413325d8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/92667/

Comments