MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 19


Intelligence 19 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328
SHA3-384 hash: 7417090b5903991986b9cd65d5b4b575938158f94fea8bf2207966728e7522ccaf9f87f2f07373aa04d74273caabf6af
SHA1 hash: 28e5c16bc91824b13d9c3b9e5d454db533399479
MD5 hash: 36c1742327cf74c0577eab9bb550cbb9
humanhash: ink-wolfram-earth-cold
File name:SecuriteInfo.com.Win32.MalwareX-gen.12424.10533
Download: download sample
Signature Formbook
Create hunting rule
File size:1'172'992 bytes
First seen:2025-07-30 03:34:45 UTC
Last seen:2025-07-30 21:20:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:HuJdwsranGbTxAcBxv6Gz5rvPhBhTNM1VP7Op7534VVV5:HuJdwsranGXxTwG5xBhBSNapY
Threatray 4'223 similar samples on MalwareBazaar
TLSH T1F14549E291A548A5D4B35DB18812E8373252AC9AD82385198ED7FF5BF4F3ED30C23947
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 8e8f0f0f964d4d2c (4 x Formbook, 3 x AgentTesla, 3 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
69
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.MalwareX-gen.12424.10533
Verdict:
Malicious activity
Analysis date:
2025-07-30 03:35:08 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/549605ea-2b0f-4e8d-a360-df4e66765349

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/17705/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.12424.10533.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688992fdaf3050dc8d325084
Tags:
virus micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 bitmap lolbin msbuild obfuscated packed packed reconnaissance regsvcs rezer0 roboski schtasks stego vbc zero
Link:
https://www.filescan.io/uploads/688992f513488cfd44dfbc1c/reports/b26fa136-5559-48c4-97d4-36cee328c346/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/02179e1c-9338-4bfe-843e-3bdbd5b87991
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.23 Win 32 Exe x86
Link:
https://app.malva.re/file/36c1742327cf74c0577eab9bb550cbb9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2025-07-30 03:35:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
23
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=igub2b3eywf3zjhltonpo7kfpa2zauyus6kv7ccbylyxjece2mua._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
2ebe448b225b2cbea4ebb0432a123738581c0a6074f831b8e115ee93163fe94d
Formbook
41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328
Formbook
6bd023fdf28fc9fccccba5b32005e516ed41e7cfeac0f346a9e637219845e591
Formbook
8e9a61c4734a27293619171258fb7f17854b643e4566e0cf0cc873eae78ab3d9
Formbook
add6f69cf908fb21c82e67c5a48f1b9c2bcfe994a240e09f889d4df73c2783f0
Formbook
error
Formbook
+ 4'213 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/250730-d5hrpavthy/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2c075fa2-2cbd-4f7c-97b1-789e00d8d7ec
Unpacked files
SH256 hash:
41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328
MD5 hash:
36c1742327cf74c0577eab9bb550cbb9
SHA1 hash:
28e5c16bc91824b13d9c3b9e5d454db533399479
Link:
https://www.unpac.me/results/ef926206-fbb6-4832-bd94-3ae3e12732b3/
SH256 hash:
8cb36a0f512efc1d22285ba95651fda9c2278d17e3cfd7a8e53bb3472aadeb03
MD5 hash:
f1011499bb42c6a1f1082e612b203e26
SHA1 hash:
1f150dcfa341e95d6779b957420ace31f50b0217
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/ef926206-fbb6-4832-bd94-3ae3e12732b3/
SH256 hash:
278bcb3053256447c4039100b8c18a4170ba869dd7accdcde7ffffe7f6571315
MD5 hash:
11a316f1cd540617b55691c0159c956a
SHA1 hash:
676710df9591ef44a02185f0b07520413dd0f511
Link:
https://www.unpac.me/results/ef926206-fbb6-4832-bd94-3ae3e12732b3/
SH256 hash:
6602459e917db58b17b53efcaa362098586828fb2cc861bf4158a64857483209
MD5 hash:
9d830fab59624d6820d261b39c5316b8
SHA1 hash:
e14d1e0eb5c9223920fef1028ab7f7c67f0782c5
Link:
https://www.unpac.me/results/ef926206-fbb6-4832-bd94-3ae3e12732b3/
SH256 hash:
90e58c6245ee4ee7a4d01157b3f0acf3c3031c804d223fec3f18157ade06b229
MD5 hash:
c5bee6289dec7da7414237d0430d59f4
SHA1 hash:
f33e4fe3b5780fb316590969fa56fcadd36c2111
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ef926206-fbb6-4832-bd94-3ae3e12732b3/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/41a81d0764c5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41a81d0764c58bbca4eb9b9af77d45783590531497955f8841c2f1749044d328

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BlackGuard_Rule
Create hunting rule
Author:Jiho Kim
Description:Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/17705/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments