MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a
SHA3-384 hash: 28368150852aa76dd55f27a098706f50bb64b788b6f4e7935655d3e90cd3e3dc3be5d2cfa89bf0168ec134f82fc105b1
SHA1 hash: 21e656d5ea5d75b552fb2f8225bcb3266324fc2e
MD5 hash: 798b7289d20295512246e9ba73b0bcc2
humanhash: echo-idaho-fish-video
File name:5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a
Download: download sample
Signature Formbook
Create hunting rule
File size:803'328 bytes
First seen:2025-10-09 14:20:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'604 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:S0Md41DGm/UwToeLAwJ3IXJp3VPR0vHvxR:KqGZYxEwC5phGvHvxR
Threatray 1'894 similar samples on MalwareBazaar
TLSH T18D05016463AEDB01E0FA1BF01970C3700BB4BD5AA821E2065FEAADEF79357415D61363
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a
Verdict:
No threats detected
Analysis date:
2025-10-09 16:23:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ac65a04b-f9a3-49ba-b9ab-b6f2090ddec5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31454/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e7c5f8277c2bd8bc5e65b6
Tags:
dotnet micro smtp
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm fingerprint packed reconnaissance
Link:
https://www.filescan.io/uploads/68e7cdfd5a3bccf09ebf55e0/reports/a3f313e0-290f-4670-b471-b6d1c46d5dda/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-19T03:47:00Z UTC
Last seen:
2025-09-23T06:40:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/097983d5-60df-43bd-897c-bdffab78f3f0
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.42 Win 32 Exe x86
Link:
https://app.malva.re/file/798b7289d20295512246e9ba73b0bcc2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-09-22 00:08:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=luz4e7mngtu3qlc23yo6g5oirlpcuwfrcsknqayebmc7cvu36iva._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
unc_loader_078
Create hunting rule
Similar samples:
04b61b0360b6c403762cb1f4d6208748fa87b0f7a964d9f68f6fe37407fe1624
Formbook
10898c09830634012bc320ad02afc6120f285bada5b22db95687d0796e3d86d6
Formbook
2429cd622638b429d7a019f1911e9673e95b0aac9093d95db83144db4f7fb7b4
Formbook
583cd2c26e0d7bc786d76dbf50dd0a76c8026aafd39b6f932ee7dd6c4faa4601
Formbook
9e896f9419ea6acaffb5770d2ad2922fc4880b52e1ebfe561603e281f942fe62
Formbook
b140ed87f2ba5d4ea5781adb9abeb567c743c2edfcb330d2fcd93f7a72eb5220
Formbook
e5736df87221b67a2e2a614374e1d6353043b95e08448ea9260e103ab18a5c8d
Formbook
error
Formbook
+ 1'884 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/251009-sbrvtsfm3v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/db76c812-0db9-4ae6-af57-bb8428f49257
Unpacked files
SH256 hash:
5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a
MD5 hash:
798b7289d20295512246e9ba73b0bcc2
SHA1 hash:
21e656d5ea5d75b552fb2f8225bcb3266324fc2e
Link:
https://www.unpac.me/results/9d20c963-147f-4629-a8a1-430a0b4b37df/
SH256 hash:
80b4386fe5b4ef1cd5b7e34ce7b3c6c741e7aa743164b9e6f3820bda2337e586
MD5 hash:
7b069ce157d7dbc98a1df8f39279db32
SHA1 hash:
106e96e766717151b1dffea81bdd157e762b1e18
Link:
https://www.unpac.me/results/9d20c963-147f-4629-a8a1-430a0b4b37df/
SH256 hash:
1041b538ccbc7d66e59247ef7551cde9b6c282843541585e9190a8e2e3943b12
MD5 hash:
e870d1e8f3791ccc141f85f40fd2972b
SHA1 hash:
150919ee289cffa6feb40ab8261f620dd7e26aac
Link:
https://www.unpac.me/results/9d20c963-147f-4629-a8a1-430a0b4b37df/
SH256 hash:
e010492423a3e65782469716776537cfd24bec4e9523d92612359070bcf77be5
MD5 hash:
5036bfd7cf743dd7cd8351fb29748559
SHA1 hash:
5533de91d513ff095543e9e3b48368ddcaabdc3f
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9d20c963-147f-4629-a8a1-430a0b4b37df/
SH256 hash:
3d3f0035c27e12329e6ef807057c62227a137798f34ac6287bf45a3bf12fd587
MD5 hash:
29c92a68a1fb0fd15d1e11019d87ca8a
SHA1 hash:
5f10dc4476826b800b06a1e520ba157756d72c96
Link:
https://www.unpac.me/results/9d20c963-147f-4629-a8a1-430a0b4b37df/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31454/

Comments