MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a
SHA3-384 hash: b1d2496ba8b0c1889c8fa4997d091dcdcb1bb8e618c79a38efc5dc6c18b9dc2c974c0e18e5a856029da0037875c13ea5
SHA1 hash: 286fc6cb82583fec07c251e5efa1ae716e4c8806
MD5 hash: f8c4ce0cf80f78b981d0825e6c691068
humanhash: chicken-nitrogen-mars-virginia
File name:3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a
Download: download sample
Signature Formbook
Create hunting rule
File size:679'936 bytes
First seen:2025-11-06 11:04:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'809 x AgentTesla, 19'728 x Formbook, 12'280 x SnakeKeylogger)
ssdeep 12288:/Af74Gjs3GshwsNBsEuxAXDD0l0zLEeSG03g:/Af74GgWRs/vuDeErg
Threatray 2'150 similar samples on MalwareBazaar
TLSH T1CAE4F148274EEF11D9E26BF80A71E3B113B49D4CA920D3174FE96CEB34A9F592818753
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a
Verdict:
No threats detected
Analysis date:
2025-11-06 17:35:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9f7e5f76-8e8a-4ffe-a47f-0efbe5ce9955

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/36011/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c8122ea0f3e915c238952
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-21T04:11:00Z UTC
Last seen:
2025-11-08T06:19:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b4c57b3-4421-41e4-8a5e-a2e50afea26e
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.47 Win 32 Exe x86
Link:
https://app.malva.re/file/f8c4ce0cf80f78b981d0825e6c691068
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-10-21 09:32:01 UTC
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hb3nnlrghezd3gbop4hfofatbk6escdhizju2rx6rjseivpfr2na._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
2429cd622638b429d7a019f1911e9673e95b0aac9093d95db83144db4f7fb7b4
Formbook
44a2b2a04288b8a218d80ea21b9b96de167b844fa7481adfbd48cfdf179aa0df
Formbook
69ae2e849e4b148f879630ae9e3a4f991602cc6a658dd732dd775c31839d69ce
Formbook
af0479c951a33eabf8ffe589a8494781e8e071599a916da305bd1852b58f1a5c
Formbook
c34753d6a802dcb3570354a7ecc7e930d957a28cca0d63e698ac0c0cbe67e6cc
Formbook
c38c0cf6caae09abb251a613fd891d105e2c37424817f5b005154f34920edc3c
Formbook
ccc0b9b62c26f70e3ef5559b35c531e2b2b049b9da0b2275f0f6e5d0801ba0ff
Formbook
error
Formbook
f3e615622500ad4051830519118058c6a7d31411605a93c85a042512bffe9b3c
Formbook
+ 2'140 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ned5 discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/251106-m63mxswkek/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f17fcd8b-f154-4d75-89e6-56603f7369e5
Unpacked files
SH256 hash:
3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a
MD5 hash:
f8c4ce0cf80f78b981d0825e6c691068
SHA1 hash:
286fc6cb82583fec07c251e5efa1ae716e4c8806
Link:
https://www.unpac.me/results/b283e655-2e36-488f-9e7f-735e4831d2b4/
SH256 hash:
d514eef0731c93596f5072a8e7cf2bd7deeb4d27492adb718bd3402375e5e4f9
MD5 hash:
a96c3849084dac362632725c1c9cbb10
SHA1 hash:
2a8e3f3e98c9739394f4ffefc24dec2ef5285ad8
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b283e655-2e36-488f-9e7f-735e4831d2b4/
SH256 hash:
9f2bdadb8926bf6157c7487e994ec28657f9415fd2fdf97a5ba82ba12e24046a
MD5 hash:
0e1119a6df48b550ad1353d136297ef3
SHA1 hash:
3f89b2297c1e0a29932eb25741a51538e005d565
Link:
https://www.unpac.me/results/b283e655-2e36-488f-9e7f-735e4831d2b4/
SH256 hash:
bea2b3772f3b8d6080d73c4394e6d31c1b11439b3aa0757ee896e4b012a32071
MD5 hash:
1860bb45313d84653e9c2e56418477e6
SHA1 hash:
d0d2d21deed3616939c3a761b020fe056320a643
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Formbook
Create hunting rule
Link:
https://www.unpac.me/results/b283e655-2e36-488f-9e7f-735e4831d2b4/
Parent samples :
8f17841505de864d0a7526bc047ee3abd5c48197f3a0e6808cb542290d15e816
3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/3876d6ae2639323d982e7f0e5714130abc49086746534d46fe8a644455e58e9a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/36011/

Comments