MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f
SHA3-384 hash: 80748e88e0ba37cc5e962f63c97fff914ed76c43b0e4a77571988c3b775783d1fcc2d0b8c761e5b7540d1508b09588ec
SHA1 hash: 6eb347a1895fc962917c24e2fc6782e4aedaa63b
MD5 hash: fd500a70f2086defb9c743390175060c
humanhash: green-seven-snake-fish
File name:SecuriteInfo.com.Variant.PasswordStealer.Genie8DN.13.1502.11840
Download: download sample
Signature Formbook
Create hunting rule
File size:790'016 bytes
First seen:2025-06-12 08:28:50 UTC
Last seen:2025-06-20 08:01:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:JWQC6Qn3E5WyobVpTfgh3ASZumPOQ2L12dB/SPcHu/g3OENsdARhdNO:J3+shobbTkQoL2I/JHuI3zR
Threatray 3'000 similar samples on MalwareBazaar
TLSH T105F402951686EA07D0934BB85DB2D3B412BC5EDEA402C327CEEDBDFB7D35211B8046A1
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
5
# of downloads :
498
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.PasswordStealer.Genie8DN.13.1502.11840
Verdict:
No threats detected
Analysis date:
2025-06-12 08:44:52 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/cf3f5e98-12c1-4086-b482-1260abf1ba24

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9090/
Detection(s):
SecuriteInfo.com.Variant.PasswordStealer.Genie8DN.13.1502.11840.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684a919707b5e8c1cfe66530
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/684a941afd02ed5e05a60f2f/reports/d4d263a4-5d36-40db-863d-927cea54a62b/overview
Verdict:
Malicious
Labled as:
PasswordStealer.Genie8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/200b267e-9e8e-4e38-a1a2-202e05be310c
Result
Threat name:
FormBook, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1713001
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-06-12 07:07:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lyaascnprfxea3wnawunnkeagirvnlb55ma5uh4wjif3bmrfhghq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
16fc60f543f67f8b5e50902fa78efd66ae2c3b16212dad6a07c0d467a28e27e8
Formbook
4a8436b32c7ab7bf4942224b5728168e4686f082529831799f358ab54d87f328
Formbook
97cabd864081313e9269c013f902117e60dbbcac4a7e7953eda96b306a9f2f73
Formbook
a73949bad5ca02ea335dbdd137b4167df29cf443444fbc7e1a491cc728bcc143
Formbook
dd2c856d18e6b598654b821f3d3185ed8563a26e9e65a45676d4d7f869798d80
Formbook
error
Formbook
+ 2'990 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250612-kgbrssvvhv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8c1787e0-d1cb-4a4f-9cb2-1565863987ab
Unpacked files
SH256 hash:
5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f
MD5 hash:
fd500a70f2086defb9c743390175060c
SHA1 hash:
6eb347a1895fc962917c24e2fc6782e4aedaa63b
Link:
https://www.unpac.me/results/3a12e18e-573f-4043-9f12-e41d84b0ee48/
SH256 hash:
96e9950cf67974cb77800bfde13101e99a4e42f3cb9d72c3bc23231d84556f43
MD5 hash:
c779c93bc76b82192b8b4e404bc057f3
SHA1 hash:
a66b3d25c0e0fa462bb97091591002a43c89b887
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3a12e18e-573f-4043-9f12-e41d84b0ee48/
Parent samples :
b5bdb3730680b32893f9c4d355682be1582689788762469bdb4efdda8376a57b
5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f
47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada
00181f3297555dab913f5777fc7823c4882929ee81cb52430d19714b8fa85734
ce161a633b539864473065ef127ba76ce9c2202aaee184dbbee5968563462a74
156ffbc1adf860198501bf76e6428debdfa847e13e73796ee9bad6e982bf94d4
b7ca5eee2c0af78525e33094a2c1d38f639824b8f051a50216dc47417f426bba
07b152394aab317e08fc56aa9fd33236cc8ea7a71d58ab9d7660ac70ccb495ec
ecca275df0af28dbbd0b0d74c0eaf5b29194cb5293f1ccdd2ba87f203481852a
5f811f675d487ef9d0cd10ba5f095edadcb38eeeedaa5ec897b3994b954d3212
b72fd1024afa07ad46cd25049ae1ef5e7311b1b2bae35f769263332cf2e7d17d
61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734
SH256 hash:
43d7ad91e64103cee999ad876aae74c8ceb1f22644e9257a1daa437251d82486
MD5 hash:
f8e0c17dc0dc6299ad899577ffa42918
SHA1 hash:
bef7526d3735fb7dca2a6336cb5c0c266d0db433
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3a12e18e-573f-4043-9f12-e41d84b0ee48/
SH256 hash:
00383de0838a17a8d61ca4375fb8b275297337d6cce73afe108efa35018058fc
MD5 hash:
9850dea4433e133e33091b18c7a6bb32
SHA1 hash:
d739029a85827add4061388535457d264f22ac7c
Link:
https://www.unpac.me/results/3a12e18e-573f-4043-9f12-e41d84b0ee48/
SH256 hash:
dc03fe83b88ecd1086340cf60835c034e6a1dc13538bc872ee54e5b62ea996d8
MD5 hash:
8d9f571c83edc271de7077347418d417
SHA1 hash:
ecf49ede1240ed0582260fd0943a5b1fff0b470c
Link:
https://www.unpac.me/results/3a12e18e-573f-4043-9f12-e41d84b0ee48/
Malware family:
zgRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5e000909af89/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9090/

Comments