MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 13

Intelligence 13 IOCs YARA 20 File information Comments

SHA256 hash:	54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0
SHA3-384 hash:	a04a8e0e60b8ba24104cd92b78d96269e3fc2616841140d8959a547a81eaab3ac229bb234368154698658dc2ba341133
SHA1 hash:	05a6e4dd7de0785f97698abb902d852c80eeb416
MD5 hash:	2031055a55c02252c1e659d9ebe597b1
humanhash:	one-princess-fruit-hawaii
File name:	54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0
Download:	download sample
Signature	Formbook Create hunting rule
File size:	770'048 bytes
First seen:	2025-07-02 13:43:52 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:QUnbUtHYuUUqMYoHh4NMwQ/1Kzcf34WOowFP3vZh79CEuwosu:QUnbpu7qJseaj/7VOlvhnZosu
Threatray	3'737 similar samples on MalwareBazaar
TLSH	T149F4125E6AC748E2D0A53F7489A3C2B94A243FD654B3C3C76FD63C4F3867A516202726
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	1a71c0aaaaaa0203 (10 x Formbook, 2 x RemcosRAT, 2 x SnakeKeylogger)
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0

Verdict:

No threats detected

Analysis date:

2025-07-02 13:42:17 UTC

Tags:

netreactor

Link:

https://app.any.run/tasks/5695055d-bc89-4fa8-998e-e4b7816f8238

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/12034/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686537ab900df8e7f8657bd4

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/686537a9714e106cecb9edb9/reports/ce2ed962-6dad-45bf-94ec-272ca8d7712c/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3ed3b894-1db1-417f-8c9c-5e9c39c7b658

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/2031055a55c02252c1e659d9ebe597b1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0/

Threat name:

Win32.Backdoor.FormBook

Status:

Malicious

First seen:

2025-06-26 05:15:34 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 37 (72.97%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ksq2algemzwrejsk2rsjdvvstk3ga2y5tplbxj2fiwqcq2tnmsya._file

Verdict:

malicious

Label(s):

unc_loader_037

Formbook

54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0

Formbook

5cefe3ee9cc0cfaa22ecb978dc503e5cc3ef2a47161906478a535a8a43e96335

Formbook

88170c9fa79e032ba011d0c8b8106e480bcb37985833a84cfe4263c778e421b6

Formbook

99816cd2de501f26cb3227491cf3bf407fba47ed12f8b925a993d7c822b031ae

Formbook

e462d1a4674d1c46ee7c3eba187353dc4c6c40863493e67b3d1ab379714f97bb

Formbook

error

Formbook

+ 3'727 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/250702-q1wh7sxwax/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e53df6a3-e5fa-4658-9af4-b35e8efbeae1

Unpacked files

SH256 hash:

54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0

MD5 hash:

2031055a55c02252c1e659d9ebe597b1

SHA1 hash:

05a6e4dd7de0785f97698abb902d852c80eeb416

Link:

https://www.unpac.me/results/6f7a07ec-022b-4bc8-9aff-8c06ca812dbb/

SH256 hash:

16b286e265bf73d9306fdcf18b6af9aa68bcd5322cb250cb66b1b14a220c88d6

MD5 hash:

9d1364afa57b30b1f4eea413809f2d08

SHA1 hash:

66bc8a0b0e37e21dbb5fe5a2050e2522391067e1

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/6f7a07ec-022b-4bc8-9aff-8c06ca812dbb/

Parent samples :

649facade465ad92983e7f91f592eed9b04bd84bb4d2d78fcee013dd004f8758
c401d93c025614d076cdc77495da4b3e534557b4d3054ddec1321b5ed821c7b1
0399cc610cf9002129dfd6666006b3c1469fa796c19e96540aed28cb4e9689c6
8c8cba879983d9f4d37fd6fb13d1062ce7a56b83d52d57bf54121523fb74e554
15b92edcf23a5909fe0e197a24cf219a28478c5d4c4c129fbcf776b02ac4dfe0
54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0
1fbbd76779084cc1c6abdc0589285d263f1cc021c7977e7f9fef6bd4db8ab892
024e0ec6668fa78bb43f5d05ae30588e82c4429fdbf36034cbdd9895aee4e458
e103bcdfd02f8bd71180c91e1556399164982ff533ebbfe1e1b5c0b3e96657a4
e5d4ea9320972fd846b5e00cb7d3b36d1877b6e80733c3846fb9a8eda3606170
b818b605201bf6f9f32df1b0a0eafb5fbb560d17b44ebcef93be9be1c607238f
b58bbe7af3c222792a084491fa7aafe763a8c8c60b7795b1b06c0011e087d23c
8925d70e07b4ecfa4193aaf2d3e72649a6d4795dc533c305208b181a38ad3213
4b41957150ba1873f1b450400ac2bf7d88c96acb6a4bf01c5ffee306598500bd

SH256 hash:

6856e700a1dabb96cbb38a9e4a354578b0c52b8db6ecc1891f56f449365d3c12

MD5 hash:

e6b68ff2a99ba9fa1ce25e741200bc85

SHA1 hash:

8faccb8b420d7573d6b14bee6efb8e85abd5c726

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/6f7a07ec-022b-4bc8-9aff-8c06ca812dbb/

SH256 hash:

bc4125260315559c104a7283982ebd8157f2299dea80c5d469cf23f6355b6e95

MD5 hash:

f8e7213f16b74099613e8bc63fd0b2e6

SHA1 hash:

ba1b47ba888a880fb3c4a291c57f90e6dd32b33f

Link:

https://www.unpac.me/results/6f7a07ec-022b-4bc8-9aff-8c06ca812dbb/

SH256 hash:

2f80576e2250173cb6c3947c8c9b90097b06adfa89da40058a24e78065d5283d

MD5 hash:

39e37abbcdfd87b642a61b154e158600

SHA1 hash:

61865e4d46ae9dc4a8a9af0db22430ee97f5cc06

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/6f7a07ec-022b-4bc8-9aff-8c06ca812dbb/

Parent samples :

54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0
22bfdf4ec2732b1eeb75d671dfb2b417f64242b9f30e366c1207cff835a3e175

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.61

Link:

https://yomi.yoroi.company/submissions/54a1a02cc4666d12264ad46491d6b29ab6606b1d9bd61ba74545a0286a6d64b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/12034/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample