🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 476d7d093d3895b58b30ed00330b1aea04f3c42ba2b99ad1def4bddcc6ea5f50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 476d7d093d3895b58b30ed00330b1aea04f3c42ba2b99ad1def4bddcc6ea5f50
SHA3-384 hash: 96de795a6bcc8a559090331e8a14ac2eb2671553d6b9f9dcd4a34fe263636f96b1cddeb13aabb501f0f6fae8b8ccdede
SHA1 hash: ba4f0ae9cb8a8fdb3e513817f40053fc7ccd52aa
MD5 hash: e5866f6def405b6628a696ab6a30749a
humanhash: lithium-north-fix-item
File name:NewXQuote.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:771'503 bytes
First seen:2026-10-13 19:11:54 UTC
Last seen:Never
File type: rar
MIME type:application/vnd.rar
ssdeep 12288:CzTmsPLNy36NYlPYZZ9EdTeh9eRD13VccyKmjnG2P/aoA7a28xLcQyTe4iVkX6iq:21g3WYlAZZ9WTea1Gzjb/nA7ajJuaVGe
TLSH T15EF43361CD7DB3DD116A8060A0E0EA40584F798B5778E56E2445AC2F26B0CC3DEF77E6
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter Anonymous
Tags:FormBook rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
BE BE
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:New Quote.com
File size:875'008 bytes
SHA256 hash: 3e90ae50108058edcce2b8e6410c09a9ca77a55138a14f04fe66c5e5bcce77b9
MD5 hash: 77547086227d620ac984e04781490ba1
MIME type:application/x-dosexec
Signature Formbook
File name:32512
File size:20 bytes
SHA256 hash: 09f0ea6df3b97a5dbc2d816916f264e4937d25ba2ca5e4500f1b4502d6d4560a
MD5 hash: 0e1d64f5eeee693d54c62f92b4f4fc28
MIME type:application/octet-stream
Signature Formbook
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1ab5f6e3-8ad9-4fe9-9dfe-ffa16f2eaaa4/
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.41447.487.8677.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad12e436f551121ba164243
Tags:
shellcode virus cupi
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6ace828fb37ecb0d5143fa87/reports/91070fc3-56bd-4beb-bdf2-b9dbd7dbde04/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/476d7d093d3895b58b30ed00330b1aea04f3c42ba2b99ad1def4bddcc6ea5f50
Verdict:
Malicious
File Type:
rar
First seen:
2026-10-12T11:29:00Z UTC
Last seen:
2026-10-13T23:19:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/476d7d093d3895b58b30ed00330b1aea04f3c42ba2b99ad1def4bddcc6ea5f50/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout Rar Archive SOS: 0.33
Link:
https://app.malva.re/file/e5866f6def405b6628a696ab6a30749a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/476d7d093d3895b58b30ed00330b1aea04f3c42ba2b99ad1def4bddcc6ea5f50/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-10-12 21:25:19 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
24 of 38 (63.16%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i5wx2cj5hck3lczq5uadgcy25icphrbluk4zvuo66s65zrxkl5ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/476d7d093d3895b58b30ed00330b1aea04f3c42ba2b99ad1def4bddcc6ea5f50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Runtime_Broker_Variant_1
Create hunting rule
Author:Sn0wFr0$t
Description:Detecting malicious Runtime Broker
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 476d7d093d3895b58b30ed00330b1aea04f3c42ba2b99ad1def4bddcc6ea5f50

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments