MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
SHA3-384 hash: 3bd231100d589a8fce18316ac14cc97d09b3c53e83f757e57cc015c9cc0996408d750f4abd83212f06bf422b85a2aa74
SHA1 hash: e0bafacf3b695965833ec65a28bd41da7a8fb684
MD5 hash: 056de58a89ff6d659b9e5dc6fa9a9383
humanhash: seven-kentucky-magazine-april
File name:428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
Download: download sample
Signature Formbook
Create hunting rule
File size:903'168 bytes
First seen:2026-02-05 15:19:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 24576:Y8fjU2192Ac9V6xgSbsEzpORHvq/xWHTWoNdQHxy4B:rg2192vPogxQ+C4zsxy4
Threatray 2'840 similar samples on MalwareBazaar
TLSH T136150224336ADB02C56917B409A0F2741379AE9BFA40E3478EE97EDF7972F144A40793
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/7e49df84-e745-48aa-8d52-3f6d53a1d14f/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
Verdict:
Malicious activity
Analysis date:
2026-02-05 18:25:25 UTC
Tags:
formbook stealer xloader
Link:
https://app.any.run/tasks/5913dfcc-2c8d-4596-80ca-11a6498a1b8d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51991/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6984b511117f8ed80109c908
Tags:
shellcode shell virus
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-18T22:43:00Z UTC
Last seen:
2026-02-05T09:40:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1714982e-e174-41c2-95c3-5a006e029006
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d/
Threat name:
ByteCode-MSIL.Trojan.PureLogStealer
Create hunting rule
Status:
Malicious
First seen:
2026-01-19 04:20:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ikgvtjuox5pzz7nm7kzvqi7h6sbyyu62eaahfk7hub6jzmjzkv6q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
099aab7e93cc90414b63769dba429546e4f98953f1c8304f6b8109e6fa0a824e
Formbook
27541e7a2b03816dc453852b1251e72fae6e6081984e94248d3edb7e13c780e6
Formbook
3f1bebc7b0ea5164074e72a8f77e3bc133d1d415f5db79c20385b8d5a601a1a0
Formbook
41e4dd0218aed625e7883bd3dbe43a95796360bda2e2b7fcf020af9fe5e1f1dc
Formbook
4f6f49d76b427ecd1df55d94a028a143e1f3795c938c0612ec546775395fb130
Formbook
69ae2e849e4b148f879630ae9e3a4f991602cc6a658dd732dd775c31839d69ce
Formbook
8225196d0848e0f36d4ecc8c8ef8ae592c5d172570dd4cd5aa13fbc2daae2fd3
Formbook
c34753d6a802dcb3570354a7ecc7e930d957a28cca0d63e698ac0c0cbe67e6cc
Formbook
dcba50a5be328e080a5496812c9c9d0d2f3bda66372fb376b716997e6323c16d
Formbook
+ 2'830 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:tu90 discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260205-sqe5kshy8f/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
MD5 hash:
056de58a89ff6d659b9e5dc6fa9a9383
SHA1 hash:
e0bafacf3b695965833ec65a28bd41da7a8fb684
Link:
https://www.unpac.me/results/ced554c9-a035-44ff-931a-eea3cf1a8c32/
SH256 hash:
f615401d5efc42d4beffda04a66562640a02abdeef8f82a788cb1041efc94880
MD5 hash:
946f9bba7c596fb91e59f0d174ac0c58
SHA1 hash:
37b373e410875dc266b266c7fee1ef77a36f1d85
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/ced554c9-a035-44ff-931a-eea3cf1a8c32/
Parent samples :
b3baa9567f3661525ea666b3c23e427d8550abf4ed4ebc2322121c3616c9cbef
e4ff62b66b02a6f78870344b002d83ae80391d1cc0b1651085f23f28d41f027b
4e104d928c12846758db6ba19844f9fa2482db80fa67c82bb909ebb9e146867a
e64b4314bf8f0471aa3d2db91ad949b3e88e39080524ed613f5a0e1fd29e187b
bfafcc89f89a7e1c6e8767a61b20f1b0875dc6bf5952f012f9c4aac270e3590c
1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2
45997dcc03ccfe687fc509e4e688614b059566577e51d70c18b07d250a70e3a0
428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
SH256 hash:
a1e9120eb56e07e83af5b6c929935c9084b9931d55bad7b3d87bbc86ac7306da
MD5 hash:
83d815a54bbcf5d2fd53f2f3020a3ec3
SHA1 hash:
d438ec3386ec710af12babf297092f65316cc3fd
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/ced554c9-a035-44ff-931a-eea3cf1a8c32/
SH256 hash:
aa4a94ed4db230e947bb3ce902930b400a1b80fac3d26d79dc001886b6b41fb5
MD5 hash:
be1f695d03b51640f168785c4270bccc
SHA1 hash:
509fdbe0b9410f9308f0a8e259daeb55dd0f49de
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Formbook
Create hunting rule
Link:
https://www.unpac.me/results/ced554c9-a035-44ff-931a-eea3cf1a8c32/
Parent samples :
1471b20910e2fcde628fd2b3d93885a78c6088a210c6fe8855ebd0274a457da9
a8fa5220308aa1c661186f1aa5aaa6858295d68a782efe4429018fbe41c74997
4f175db08cdf7003dfedf93074abaaebb774b5852346e93161517c909d3a0cee
61099a560e22642077a83120c7bdda1092f4040d7139e2ac03e030a329994266
428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
2b42f648d1f3c2eea55de8351293b7e66b5c2d0ecbedd7d0ed86602aa55b9dd0
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/428d59a68ebf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/51991/

Comments