MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 20

Intelligence 20 IOCs YARA 21 File information Comments

SHA256 hash:	261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141
SHA3-384 hash:	841f98e657a5c94d16a1b13f8be92709a93e7a9e0666ff01be4dfe4da1f7a3d0274d621a79a115587d43e264434dc3ba
SHA1 hash:	face2d85935e832bea32f6a23c6c8765b5c6708b
MD5 hash:	558e92f2e765548574fa652c48ef526e
humanhash:	undress-kitten-september-twenty
File name:	order_details.scr.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'244'160 bytes
First seen:	2025-08-22 16:23:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0b768923437678ce375719e30b21693e (143 x Formbook, 25 x MassLogger, 22 x SnakeKeylogger)
ssdeep	24576:65EmXFtKaL4/oFe5T9yyXYfP1ijXdafCWL6b2HrLA:6PVt/LZeJbInQRafCWLe2L
TLSH	T19345BF0273D1C062FFAB91734F5AF6115BBC79260123A62F13981DBAB9701B1563E7A3
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	James_inthe_box
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

_261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141.exe

Verdict:

Malicious activity

Analysis date:

2025-08-22 16:23:57 UTC

Tags:

autoit

Link:

https://app.any.run/tasks/ab52be79-06a3-4e10-af06-d63fb62c8c0f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/23043/

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a899ca6eed937d746d1e49

Tags:

autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Sending a custom TCP request

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

AIT:Trojan.Nymeria

Link:

https://www.hybrid-analysis.com/sample/261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-08-22T13:43:00Z UTC

Last seen:

2025-08-22T13:43:00Z UTC

Hits:

~100

Detections:

Trojan.Win64.Injects.guy Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic Trojan-Spy.Win32.Noon.sb Trojan.Win32.Strab.sb Trojan-Spy.Noon.HTTP.ServerRequest Trojan-Dropper.Win32.Dorifel.sbd Backdoor.Agent.HTTP.C&C Trojan-PSW.Win32.Stealer.sb Trojan.Win32.Inject.sb

Link:

https://opentip.kaspersky.com/261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141/results?tab=lookup

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9f3d8afd-2c10-4cf2-bb32-1994b4259c73

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141

Verdict:

Malware

YARA:

7 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/558e92f2e765548574fa652c48ef526e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141/

Verdict:

Malicious

Threat:

Family.FORMBOOK

Link:

https://tip.neiki.dev/file/261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-08-22 16:23:23 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eyng5bkykbjgwjuxuqdfejp65ezy6hrmsfxvpzqoariwocigsfaq._file

Verdict:

malicious

Label(s):

formbook

Similar samples:

error

Formbook

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/250822-twnjksbj8y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9d8e5402-902c-4e63-9aa9-f7c24a6cb932

Unpacked files

SH256 hash:

261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141

MD5 hash:

558e92f2e765548574fa652c48ef526e

SHA1 hash:

face2d85935e832bea32f6a23c6c8765b5c6708b

Link:

https://www.unpac.me/results/8b5b0bc6-7cb9-4bad-84ff-bdd8b0e69e82/

SH256 hash:

6d6e400a29e2dc8c6c5ede93e789f9e5ed22cc45ea342fcf6f2f808221a5818f

MD5 hash:

174dc227f18892598264cfc620797acf

SHA1 hash:

a9025d6850ebdc1e4987a25a9ec2799ac464c8fc

Link:

https://www.unpac.me/results/8b5b0bc6-7cb9-4bad-84ff-bdd8b0e69e82/

SH256 hash:

56f71a8da2d26dde4c2ca15d1b5ff22a39de7f09f2cfc84c6ebad75f26c31577

MD5 hash:

3388116e83535055a06384e1f9d97f96

SHA1 hash:

f749a3329d5628d35665dcaf848aea50025de554

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/8b5b0bc6-7cb9-4bad-84ff-bdd8b0e69e82/

Parent samples :

38e65102a6d8af117d96ba3159ab096d2b95ea8615408667997ce1375c00f35e
5bf3c820c4ed7b2b2e38dec099a4b76273a4e82472ced8f9cad59ba37b02dcb1
61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3
adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
adf664c4bba9af7873a7aa41ee0f2264e2757f14d8ac6619194572b58c1e7e68
2fbeb147acc6a400fdf52595966a38c61f6b323536d9a244de11067c9da57610
f0a905542b77b1e9d101dff1115070bffd1871f4c2ada0f3a95ee21081e8c671
3d4b7da0e29cdd7948064dd1a63fe86401240716d54ab1ef4d6e234e0b66807e
4857ee7f02efc4f90333790708097f4ad955beaaf41cdfe6ba11a5385a1ba8d5
2412e0910cc1deae89794bb142f6a0ec6089761fcace1f51f968b8f62bb19c32
34c4a7d2e16716cc0a9f9518718dd8efd2d36f97d2ee93721b9c2b40f4a164ce
cad6df3e9a9ac2d74b5c5276ab7192b8b876cde19259b8a567c80e44362e898f
f10a61792867b7b2d84daa851f8d24169a96cb70b55e09931a7ed2c01853634f
c3c235915752db934ca00b7c30cbcb2b5d83c2a52400ac29ccc1bd66573c534f
ad248905f0468cc57eacd8d3dadd474cd31a8b778c2a0eb952f48bdc525a1ee8
825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2
9ffbfc64827a32593bdcff306f45afaaa69cda089c1b3ed28a8889d17dbf33d0
76692d50ea8233a8ca9d3f9a89890d9a2149f0ff9859476920ed3ffc84c63f64
4caa9777053748e8ee0190b4056f93e1cc6506c212c06c67622c0cf6f476665b
a0cdffded083ccadb44b6b7841cd16580cf4638a573d2684134181dca7462d3a
6a11ab33aa16d2d8ba08cb3c6edb5e0613c1d459287261ecd907f9359068cbc8
b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
affbb0db85505a477fad583411e0361f0502ef4d9c46059da31ca85eb0e0b5d6
261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141
8c787bab18fce858e66ef04e233ec2e318503e250300628707bc833f23a79194
aa0227c6018d030ef8e31630cd92673ac3d30f7826a49059b4abfc26c77fd486
18af0ba21e4c33129d6a6774af76b2f09cf8ddf9e05fc9917c7b25a6e978e034

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/261a6e855850/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/23043/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample