MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 17

Intelligence 17 IOCs YARA 10 File information Comments

SHA256 hash:	241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd
SHA3-384 hash:	9fd33094b948fbab3812723ea6926e370cd789783f257e9ebf1aac2b185a8083e447b8c33e7d0b4a0ccbe92463d8e373
SHA1 hash:	2f0b446b3f6737fb3b0a051042771e53aa2b68ee
MD5 hash:	bdaabd600bb9371423842eb703c8a918
humanhash:	alabama-jersey-leopard-pip
File name:	SecuriteInfo.com.Trojan.GenericKD.77041406.17733.16126
Download:	download sample
Signature	Formbook Create hunting rule
File size:	754'176 bytes
First seen:	2025-08-07 06:17:31 UTC
Last seen:	2025-08-07 07:15:21 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:r2N8J+g9DcAe4LnAKLHKpJKhy5F3iYoI8cdXHukleVAUZfuik2Fs4NG0fbwDv:r2N3gLnA9DF39bXBixk2aYGN
Threatray	4'124 similar samples on MalwareBazaar
TLSH	T131F42228B1F6CB32D5A4DFB67972C17823360C56D522E3068DDE9ECB34687708859F62
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

SecuriteInfo.com.Trojan.GenericKD.77041406.17733.16126

Verdict:

Malicious activity

Analysis date:

2025-08-07 06:18:59 UTC

Tags:

formbook xloader

Link:

https://app.any.run/tasks/ebcfbdf5-ff3a-4390-a461-6bb28a599fff

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/19410/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.77041406.17733.16126.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6894450d1e8a59ee04e6ead1

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Sending a custom TCP request

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 bitmap lolbin msbuild obfuscated packed packed reconnaissance regsvcs rezer0 roboski schtasks stego vbc zero

Link:

https://www.filescan.io/uploads/689445029ef4d2ff7cefc9b9/reports/687566c9-8180-493d-9970-170378497894/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b97640d1-04dd-4b4a-9458-16c84ae01a1e

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable PDB Path PE (Portable Executable) SOS: 0.35 Win 32 Exe x86

Link:

https://app.malva.re/file/bdaabd600bb9371423842eb703c8a918

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd/

Verdict:

Malicious

Threat:

Trojan.MSIL.Inject

Link:

https://tip.neiki.dev/file/241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd

Threat name:

ByteCode-MSIL.Trojan.DarkCloud

Status:

Malicious

First seen:

2025-08-06 22:08:51 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 23 (73.91%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=eqoqbxehwxabmafhmfdacfxgdbif5s2cmp2yn32ui64mdvbst26q._file

Verdict:

malicious

Label(s):

unc_loader_037

Formbook

43761bfbd402151a82fb11d83dd01309080ce8d010df228fe65fedc2aa831b97

Formbook

6bfefb0f3b8a878aec69c3d830824c3bf7d5181ffd6d6e88dc4a8d793370c233

Formbook

a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1

Formbook

+ 4'114 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/250807-g2cytaxwa1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

SmartAssembly .NET packer

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8492b8e5-5af5-4fa4-b3d8-c9e67856aab3

Unpacked files

SH256 hash:

241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd

MD5 hash:

bdaabd600bb9371423842eb703c8a918

SHA1 hash:

2f0b446b3f6737fb3b0a051042771e53aa2b68ee

Link:

https://www.unpac.me/results/e470c251-9af3-4525-858c-128113f501a8/

SH256 hash:

6e5ae0f729a327bceefc2a7ada433ecb62251d3ffb41ea483dc7391e643dfd0f

MD5 hash:

9793092e9b13d76e3efe1fa1503759ef

SHA1 hash:

178c8b83c18aae0b3e1845c65b06d3dad71c310b

Link:

https://www.unpac.me/results/e470c251-9af3-4525-858c-128113f501a8/

SH256 hash:

fc4b67409ffa1051ecb459d32e0bfdbcaf7c62e498430d0d56c23a3e3c27bff0

MD5 hash:

7211f34e2a294d0171119f9787ca7d18

SHA1 hash:

90f402d0b28a6a218ae75f262bca85ccec6bc400

Link:

https://www.unpac.me/results/e470c251-9af3-4525-858c-128113f501a8/

SH256 hash:

1d254567cabb6b4059483bd912d10fd98294f44290e0a8a0b31fdc9d5c17a58d

MD5 hash:

68da6782e2cc079a51ef19e02d945254

SHA1 hash:

fc4ae2397ad3d7aad95dcffb5e1bdff1adcdd111

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/e470c251-9af3-4525-858c-128113f501a8/

SH256 hash:

68c7f7fe5a4f84fb3b4c1c5249dd51f47003389ab4b8ec01a46c42058858cbdc

MD5 hash:

a705ebd576e3acc942df3fe13bf9171e

SHA1 hash:

c02538489c4107ca74a0ef16529f6edde1986ceb

Link:

https://www.unpac.me/results/e470c251-9af3-4525-858c-128113f501a8/

SH256 hash:

100320b51388dda1a4b3306d6a294222eb4d2dfe67f42f8490ce4e0c7fdc5b3a

MD5 hash:

e978b8e5272347c7c831368c87056830

SHA1 hash:

263bac811ca81aaf982dce0b92b8b38bfc59292e

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/e470c251-9af3-4525-858c-128113f501a8/

Parent samples :

fae04e1753cc051af6229b382defa6367e33075095c579249473f6f467cbccb1
3b8313decdeb72e5bc04326dcb9cedf06c1bcce618e5f65d84fe5f481f9af3c0
241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd
078cabe3f98bbf49468d898d869cd8f58df0ff0a1bddd9d00524ac49dd04f3af
cd96ca7a5b5ea72b4c03e9b2363296307ea826dc504c2dd54df89c3aeae94d5d
db2b7020233579fb99689c7e706545b2d7eefa8a83ef24160831c8fc982a1b4c
c5658d0585c94a50f715384ed28507806352107648eafa58fd7764a16c382244
fea19e2a8ec0ae79fb6f25deec6ac647a53027ee3d4861be780daf205d49a718
53b1100f0b09af2d37c8df2bcd77aaf844c4424bf17d71854a5d14130881ba10
3f3bedd484f8e49e35bd9e77b1ae88b27d5efc747a44dee28277be0556653ecb
62f63b180fc726bb6d54ecba4b3edb4436e2442953b07aea87c0e60cf057417f
9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84
6baa5a857ac8045ba485189e5098242a01946a00e35a7a541d7494562137aef1
5ee3dca8cae3f74a8d15e487328d1a33c28ca7098c747f2d50e4e5547d038474
928f36967f7a7af841021d4833479ec18178d48d9c418e772d0b3d32da7a2e6d

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/241d00dc87b5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/19410/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample