MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 57e753a6d49e97decfdfd33977c017da0c19955d69b6aeb150a7f9c80bca1134. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 17
| SHA256 hash: | 57e753a6d49e97decfdfd33977c017da0c19955d69b6aeb150a7f9c80bca1134 |
|---|---|
| SHA3-384 hash: | b50224fcf3a2b07dc7a11dcdb2401383f21f5ab0f5553229283e527d11adc414a93a80b6150050b2dfa58812a03a3dfb |
| SHA1 hash: | bedb4c32c7fba7add04a51ee93c63c8abc11278b |
| MD5 hash: | 268507accff36a6f704560d6921c951e |
| humanhash: | fish-magnesium-butter-carpet |
| File name: | 57e753a6d49e97decfdfd33977c017da0c19955d69b6aeb150a7f9c80bca1134 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'011'200 bytes |
| First seen: | 2026-06-08 09:44:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'012 x Formbook, 12'352 x SnakeKeylogger) |
| ssdeep | 12288:xtI40IhcvB1NUuX7lpcO0RvOn6yWJsls3MFK85b7a0iASug10wasGnKy/1Sobynw:446BvxoRmGs+kbm0fs0w4Ik2nEWPFs3 |
| Threatray | 128 similar samples on MalwareBazaar |
| TLSH | T1A625125C5A16E206CB81677A1DB1F7B5067D2EDDB810C2139FE8BEEBB977E441C00292 |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
50
Origin country :
HUVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
57e753a6d49e97decfdfd33977c017da0c19955d69b6aeb150a7f9c80bca1134
Verdict:
Malicious activity
Analysis date:
2026-06-05 08:53:26 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
97.4%
Tags:
infosteal micro shell spawn
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
packed vbnet
Verdict:
Malicious
Labled as:
Trojan.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-14T17:00:00Z UTC
Last seen:
2026-06-08T12:13:00Z UTC
Hits:
~1000
Malware family:
Formbook
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Status:
Malicious
First seen:
2026-06-05 12:05:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
27 of 36 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
xworm
Similar samples:
+ 118 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
57e753a6d49e97decfdfd33977c017da0c19955d69b6aeb150a7f9c80bca1134
MD5 hash:
268507accff36a6f704560d6921c951e
SHA1 hash:
bedb4c32c7fba7add04a51ee93c63c8abc11278b
SH256 hash:
dfd0625711f1cd8d2d45207b722cfb182b3ef66053349186c6360f83e00798f5
MD5 hash:
88c390f305b01b1b88a8948e5c01f916
SHA1 hash:
5122b658f55ab891ecdc973383463f9bd8b4138b
SH256 hash:
e720d43edb7bf607be3f1f5f5289c1f9571a9e1a1093e620934e912b2b46f95d
MD5 hash:
e8906cfe34ffe685b6067fc06e7aed6c
SHA1 hash:
7eb7f277cb134c5d33195a51d8b8bffd4a2013e9
SH256 hash:
522b44ac02f19e54eb9e84faf8d7a23580b0f184df0c195509874d48d3935862
MD5 hash:
39ce4fdf123d2ace0208e6d749db6ba5
SHA1 hash:
c3edd643d423f493b8e78c6a14252b258b4db182
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.