🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
SHA3-384 hash: 4194b36c670883a7bfa871e40f299f07f85fbb7f1f46e34dedcf064165099e1a6a9dd1e343593537e9ebd13a952ddc42
SHA1 hash: 86ca4d6d00752507b1f12faf1bb55af0a6ec5db1
MD5 hash: 17c4d6e51c52e59ada1d644411d33015
humanhash: mississippi-undress-minnesota-hydrogen
File name:Swift_Copy_IF01200022823419.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:822'272 bytes
First seen:2026-10-09 04:37:52 UTC
Last seen:2026-10-14 16:04:12 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'298 x AgentTesla, 20'717 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 12288:J0qG0iBn3vu6SZzpX8zm/ntg9UlmygxJNl6qBgkZzE6tGOxyS+Cob0YmKO:bQB3vtKX8Mt+ygxkql4q0bbJO
TLSH T1D005DF00326BCD13D1B65BB106E1D3708BB42E95E622D3978FE66EE77A267C158C0793
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
282
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
NETReactor RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/79fa087d-70c7-4822-8a13-73fe5f769362/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-09 04:42:36 UTC
Tags:
netreactor formbook stealer xloader
Link:
https://app.any.run/tasks/21a1700d-fe0b-47d9-8e34-cf1c8fff8d3a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/91205/
Detection(s):
SecuriteInfo.com.Trojan.Cassandra.AC.31266918.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad087516f551121ba15dd97
Tags:
trojan shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching the process to change network settings
Сreating synchronization primitives
Launching cmd.exe command interpreter
Setting browser functions hooks
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Unauthorized injection to a browser process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
net_reactor obfuscated packed packed vbnet
Link:
https://www.filescan.io/uploads/6ac86fb1a8c6330d7df0e157/reports/fed2a438-b392-4b6c-9dc5-f4e186b48a0b/overview
Verdict:
Malicious
Labled as:
IL:Trojan.Cassandra
Link:
https://www.hybrid-analysis.com/sample/3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-08T22:24:00Z UTC
Last seen:
2026-10-11T02:32:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/250cbf89-2732-49d1-9422-fbf151102976
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1984630
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Unusual module load detection (module proxying)
Yara detected AntiVM3
Yara detected FormBook
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1984630 Sample: Swift_Copy_IF01200022823419.exe Startdate: 09/10/2026 Architecture: WINDOWS Score: 100 33 www.xn--80adi9acalct7b.xn--p1ai 2->33 35 www.pgsofthokix22wd.cyou 2->35 37 16 other IPs or domains 2->37 57 Suricata IDS alerts for network traffic 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 10 other signatures 2->63 9 Swift_Copy_IF01200022823419.exe 4 2->9         started        13 explorer.exe 53 1 2->13 injected signatures3 process4 dnsIp5 31 C:\...\Swift_Copy_IF01200022823419.exe.log, ASCII 9->31 dropped 65 Adds a directory exclusion to Windows Defender 9->65 67 Tries to detect virtualization through RDTSC time measurements 9->67 69 Injects a PE file into a foreign processes 9->69 73 2 other signatures 9->73 16 Swift_Copy_IF01200022823419.exe 9->16         started        19 powershell.exe 23 9->19         started        39 b62vqgms.svip-jidun.com 192.252.179.53, 49715, 80 CTGSERVERLIMITED-AS-APCTGServerLimitedHK Hong Kong SAR China 13->39 41 www.7k-casino-js7xr.top 104.21.61.193, 49714, 80 CLOUDFLARENET-CloudflareIncUS Canada 13->41 43 4 other IPs or domains 13->43 71 System process connects to network (likely due to code injection or exploit) 13->71 21 wscript.exe 13->21         started        file6 signatures7 process8 signatures9 45 Sample uses process hollowing technique 16->45 47 Queues an APC in another process (thread injection) 16->47 23 WmiPrvSE.exe 19->23         started        25 conhost.exe 19->25         started        49 Modifies the context of a thread in another process (thread injection) 21->49 51 Maps a DLL or memory area into another process 21->51 53 Tries to detect virtualization through RDTSC time measurements 21->53 55 2 other signatures 21->55 27 cmd.exe 1 21->27         started        process10 process11 29 conhost.exe 27->29         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.60 Win 32 Exe x86
Link:
https://app.malva.re/file/17c4d6e51c52e59ada1d644411d33015
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617/
Threat name:
Win32.Trojan.Cassandra
Create hunting rule
Status:
Malicious
First seen:
2026-10-09 01:05:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
30 of 38 (78.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h2qd4kgauwumrjerb4tlfipoa4yfh53mxwosc4u5z3ebkq5mcylq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:be21 defense_evasion discovery execution privilege_escalation rat spyware stealer trojan
Link:
https://tria.ge/reports/261009-e9fnkahw7k/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
MD5 hash:
17c4d6e51c52e59ada1d644411d33015
SHA1 hash:
86ca4d6d00752507b1f12faf1bb55af0a6ec5db1
Link:
https://www.unpac.me/results/5d135818-f946-4d97-a2b6-548d5b567d57/
SH256 hash:
405d0dcbe8454646de26e8b2db78435803b99dccdcbcdaa1028c56c7c0c6c3ec
MD5 hash:
3e3fb75f3074003ae2ff07ecfe6fd38d
SHA1 hash:
5200f5572d3167c84842bbff7c48506011585172
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/5d135818-f946-4d97-a2b6-548d5b567d57/
Parent samples :
64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2
354ed74cf297bdc4d920e3bb357fea7202856277501cbe914b1dfbe8813e841c
7a9bffbf3a920d9b72d73b73cf09f3be5dadf025055f42b5dd12761ab7c8dd34
461ba9a7d6b344421967b3c71630ec4796126b5f20bef32111447ac58e9b9202
a36cbacd3c6950de6319523835e895e8b35e32549c3a4673b3ead5215ad0d3e8
a8a6f5ad5f6bc59b64af1cca3bf0d5b6bcc8686a0dd8a8bb5cb244c2edcf3e23
4e2d3b193a9bfb9f3a369a251a1b722450fa13d8fc193d3c872ebf1062783fde
3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
e15e5d4f77fa217cf9ccf18fc0fff19e9b9e47d8c65413f2751904a14fcb8658
024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da
db4732a4b2646f6ddef351784943f58c27311215807a9ba670e9f687366e2a43
b7e0ed86028fb5faa05901945ae751051dc29ac8729b1afc62cc6efe17e20c0a
012ff5e0a2bed3ffa624958ccbc9da37a26f2fb65e3b994fec9d51b2debd2e39
0264d0104ae89e9c45fd1ebba3a20425e8f41cdc16e7deacec9d9608afcf8230
08e7a6e924c4e87cea2db6050812e058786714e788957cf0763b7d68943068c0
090fe0632814513fdece4b3c602cbcb5816f8e6b0b7a34ed73430ef6816ca227
152d4753839330b04a221d9e97093de27dcf5a4231fbd948940da26d909dd5b1
19b4de88df623cf3d95a7c3e84cdb51070360c4127322b5a929e9143d242d7f0
1af881666fdf368406d50e86d289b42853d9fc220cace6e82c5f0ee157d9bfae
297dc82be0b18123280967f224ce6ca4843b22e3b1bed07eb82cde8f78cdadef
2dc39c7548cdf4ccb0f00d94768aad3a3031c1ed29a24a59499bb6d558808c26
30a633cd9f1c25e9f76cdc78c3565462f14a444fe13f0689fe41de2163a89bd0
35bb5a32f866cf66288451eb5f04c568d58ae85dbd5b876abdb84932275215ae
3cbd641a2454d3b71544edd13f8b1940df511f3b9720555519bdc9740adb16e3
3e2aa99f1b2a0d56f34f65de5dcafafda48c23433881aba479bae67072059b56
4018da487297614f041f01b5bffe425f6a4ca43b045455b4c4ac20c04b92a61d
45d3d2858dff39d3c088b51b4b4c9452e562a85edf68f4d135ac0c69e73a0d75
4cfffae6cdd242838185f34113b65421a41ee3fcc726b8fa63c05d607164af4c
525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
5390935b00b4bb841bf005d0e43b603a78139295ea53b471230d24bdb5c423d1
5aee04c320bf3ed7046702eafa8c4e193a614981e955c98cf82bdb675edbecdd
5bf661ed804f6f8e0f65e3f8d3799873f72de9d486a5ffd71b79a62012f1fd83
676e61504a6d6ab4d90b5068bc487fb19c804b0b1ef0db814aa04fbe035195dd
68ca49836efe920aaad82f3db71bd22a9fb5bf72490f1535f1f7f2697f120a55
6ad2165eaa8bd199768ccd7dfe74a480e0602bd57c6a77501d01faebadb85e14
6bdf803d22cfdff13e317894ddbec9076aa67d85422414ee7d12a1d44c6b0fc1
6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
74615f020e5952fe66c8367ca324ce02b0ca3e98bb17327cb159181830b8e23e
785de4b2439f127566906ab1abbaa80562fdb730bc0e5c3f4d0d0c6a5af5330f
78ffe41ede09473d54e4808e703eac44cd6e79e2314c84ab4539c57ac0bf4033
7946937f5c65fe8d9f39b927c9a499917e72d88640cac1e34227758f241413c5
7f69d304597c8b10d0f5516fae40ef1db11030d68778464402d3cdaf3f586b41
86c321273fb1bae6a89344a1b8982b80d13c0774bb76a0e3cdfaeab1c4d5dd17
88f4f68676a0adb716b617a6276bc4f28bfb1fc732daca54c1582f70a124d86d
8d93bc348fc3702b7b5bd244f0a1fca04cf34903a72f18cc883e6b1333722644
9d66a32be3f221f882724bbd6aa9824232cbaef71ea46243b1c6927a9c569387
a924dc51efcc327e23837f61af68d2f793d36a36183c3cedb3987efca8382583
a995a81f862dc9994a8021fecfc55a7f8261974f50793e7bd8a73dab5e6b33a9
ab3d42f5dc68cfd3507849160e1b5f90589c49f1bc8aea1226a1dea6e2824c05
b059899fbc3393df19a209fa6c7faa35de15b2886c51572828f7f1e1d1088e87
c053108c5b25c38bc6d29569d2876396f4e744cad3d867abf4e566b3e4c3c384
c520275b04c1fbdabdac631aaf4141cd3fd8bc485aa9cfaed7c65e7ccac12c14
d5331e2c9e5d866d4515c825d6eb69de927810f8547fdc9dfb0aa545785a36b6
d86753e540f7ec56ae0e03335558af87e536c03bdd7d93511a5521ee28605341
e13ed2a8812eac03651272dfd4ac6a0431305ac845210907bea692dc59105526
e357b50c1c476180923e06378e54a7995e7966dbd633c3fe6edea1432c425833
ec340fcd3a19f99978cfd326a00108ce04d9c295ef61723dfe12c46fc8be21b9
ee173fe306d7834864d41b0d02327027a736c2f8517a6831da52b1b30e9a0d72
ef731669a765d81e3afae2c4f04cb729dd28c30a8fd60fa800ea6e10d2732011
f5b83f8a1394e025adad0de20e351321020d7d24b98ceafc9222b71c6a6f48cc
SH256 hash:
3e19ec14242c3430bdfd2700579abd36dd4d39ee960f680f47cab14b3db6249c
MD5 hash:
733ab54e261cefa5b3b6245e9cce6c24
SHA1 hash:
701c8053d21ca41042566e03cfc00f374f16e4a6
Link:
https://www.unpac.me/results/5d135818-f946-4d97-a2b6-548d5b567d57/
SH256 hash:
922af6ddb5911744abfdab57a4fcc647f31133bbfeeb9da493e95106d95e3d12
MD5 hash:
687ce8f944f6bcc4359e20f1393a7b74
SHA1 hash:
eb5b52893dec1401ac6f4dbb2d3ed1b3e1952ebc
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Formbook
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Link:
https://www.unpac.me/results/5d135818-f946-4d97-a2b6-548d5b567d57/
Parent samples :
a8a6f5ad5f6bc59b64af1cca3bf0d5b6bcc8686a0dd8a8bb5cb244c2edcf3e23
3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
b7e0ed86028fb5faa05901945ae751051dc29ac8729b1afc62cc6efe17e20c0a
14b357c53532689c03bfe68651c9678e8ddcfb833c03366f637aca2a354c7ca2
579adc1c3a92d159ddedc7162dce54f6b8d266c8d51cf0d7bf58197c40df538a
7946937f5c65fe8d9f39b927c9a499917e72d88640cac1e34227758f241413c5
b2b362f2c0cf692201dcb08dc12f86ea80e94f30586569bff5647bafb232dce4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/91205/

Comments