🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a
SHA3-384 hash: 52a3eff8144fbce41719a71a661cc5c2051eafe1f3f7a74bf7e0e8f0cbefa0fd17b64b46a21a76c6c91b8d3e7597e929
SHA1 hash: 78c69adac0710e8ee3fa14f442fb1dce22ee4bb3
MD5 hash: bf1e808d7e6812bed9d86fd5aea256dd
humanhash: twenty-music-idaho-beer
File name:EX770068372396.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'238'016 bytes
First seen:2026-08-25 09:47:30 UTC
Last seen:2026-09-10 11:08:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'239 x AgentTesla, 20'492 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 24576:kPJGFsijP/2oSdvZfyluDjAQTqclTmfKXaY1l/V5zyr71Ik:k41b/2oSL7jhTaYb95en1
TLSH T1FA45DF9C3210F88FC4579E728964ED74AA202CA6970BD30395E72DEFF91D59B9E041E3
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
ConfuserEx RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a3ff5e7a-5ee9-4afe-b762-4dc922b98072/
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/82700/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Blocking the Windows Defender launch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
confuserex confuserex confuserex obfuscated obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6a8d64d6fcdffd8578d9b68a/reports/564aa64c-f285-454a-a093-e04533175e34/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-25T06:39:00Z UTC
Last seen:
2026-08-27T08:03:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/060a5bab-80cf-4919-aeb9-7985f6b89fd0
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1963231
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected AntiVM3
Yara detected FormBook
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1963231 Sample: EX770068372396.exe Startdate: 25/08/2026 Architecture: WINDOWS Score: 100 31 www.bandatransportoare.xyz 2->31 33 www.yaksamedia.com 2->33 35 11 other IPs or domains 2->35 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected MSIL Injector 2->45 47 Yara detected FormBook 2->47 51 4 other signatures 2->51 10 EX770068372396.exe 3 2->10         started        signatures3 49 Performs DNS queries to domains with low reputation 31->49 process4 file5 29 C:\Users\user\...X770068372396.exe.log, ASCII 10->29 dropped 61 Detected unpacking (changes PE section rights) 10->61 63 Detected unpacking (overwrites its own PE header) 10->63 65 Unusual module load detection (module proxying) 10->65 67 Switches to a custom stack to bypass stack traces 10->67 14 EX770068372396.exe 10->14         started        17 EX770068372396.exe 10->17         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 14->69 71 Maps a DLL or memory area into another process 14->71 73 Queues an APC in another process (thread injection) 14->73 75 Found direct / indirect Syscall (likely to bypass EDR) 14->75 19 RwCv7dsh0FOx8z.exe 14->19 injected process9 process10 21 getmac.exe 13 19->21         started        signatures11 53 Tries to steal Mail credentials (via file / registry access) 21->53 55 Tries to harvest and steal browser information (history, passwords, etc) 21->55 57 Modifies the context of a thread in another process (thread injection) 21->57 59 3 other signatures 21->59 24 25CFN6YRpcDka.exe 21->24 injected 27 firefox.exe 21->27         started        process12 dnsIp13 37 www.bandatransportoare.xyz 185.46.40.240, 49717, 49718, 49719 ATAK-ASTR Turkey 24->37 39 ibratin.online 162.241.2.203, 49748, 80 ORACLE-BMC-31898-OracleCorporationUS Brazil 24->39 41 6 other IPs or domains 24->41
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a
Verdict:
inconclusive
YARA:
8 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.86 Win 32 Exe x86
Link:
https://app.malva.re/file/bf1e808d7e6812bed9d86fd5aea256dd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-08-25 09:25:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6o7oaejdoupz6iyvc6n2ut5see4pcel4iqbq5x2mtltx7op3gfa._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/880b243d-dae8-47df-8707-d337a5cdfdcf
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery evasion rat spyware stealer trojan
Link:
https://tria.ge/reports/260825-lstx7azdre/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: Formbook
Formbook payload
Modifies Windows Defender DisableAntiSpyware settings
Unpacked files
SH256 hash:
4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a
MD5 hash:
bf1e808d7e6812bed9d86fd5aea256dd
SHA1 hash:
78c69adac0710e8ee3fa14f442fb1dce22ee4bb3
Link:
https://www.unpac.me/results/f27f2035-8305-440e-b1bd-7d3886c69069/
SH256 hash:
0d5db9542d16364e40394a0367b85d57365dfa216f1e6d29f8ed291f41a10f05
MD5 hash:
11206d5b4a2c1fa6f0927545d63259d2
SHA1 hash:
53ffd9ee189a8cc27a162ccca59adc0b387cd588
Link:
https://www.unpac.me/results/f27f2035-8305-440e-b1bd-7d3886c69069/
SH256 hash:
ce90ea9a61b22ed7e0a3481e3fce54872bd5f37aa279c6e81c30201a7f33a968
MD5 hash:
2e4b547a239931138b1226e19508f598
SHA1 hash:
ea1be635b4a9cb6f6340ac9368a34e2dd3b7ed93
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f27f2035-8305-440e-b1bd-7d3886c69069/
SH256 hash:
0aca3c39b8c20307b95837586d3c02a49b22613ca19469819af9716a066f6eb0
MD5 hash:
1f47e045ae948e114c740b5f31d40ca5
SHA1 hash:
eff74fa9390241d126ce837d3cf2a6fe21142e32
Link:
https://www.unpac.me/results/f27f2035-8305-440e-b1bd-7d3886c69069/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4f9df700891b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/82700/

Comments