🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 18


Intelligence 18 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3
SHA3-384 hash: 062f56c9f3eb8fa1bc155cdb316048768f0c19aa4a862efae68c91d007f00f7808fee9826e0580a1b5bf973dc8736e03
SHA1 hash: ce913161d5374b5920b2c6b2f15f8209c4cdcbf1
MD5 hash: ec9a864f9199b0d90e53829ddca054ae
humanhash: paris-iowa-nebraska-eighteen
File name:5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3
Download: download sample
Signature Formbook
Create hunting rule
File size:1'152'512 bytes
First seen:2026-10-19 07:41:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'291 x AgentTesla, 20'706 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 24576:+zh2gM2WsXmQ/nVIFXTKePckGs+kNqvdHFKQV0VjRTaETuzCg/1:+tvJTWiVIFXFVCZWQmVjRuETub
TLSH T1DC350110221ACE02C4BB5FB41931E2F81B745EDAF921D2538FEABDEFB97AB141545342
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/bc46a435-4cd5-437f-89ab-471fc4ef27bd/
Malware family:
guloader
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-19 08:59:29 UTC
Tags:
netreactor auto-reg guloader loader
Link:
https://app.any.run/tasks/2b0142c4-f4da-4ee3-86b7-390e6971be42

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/92674/
Detection(s):
SecuriteInfo.com.Trojan.Inject7.2544.14698.31594.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad5d33aafb06e650cd7d569
Tags:
virus micro cupi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Creating a file
Creating synchronization primitives
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-01T05:08:00Z UTC
Last seen:
2026-10-19T02:27:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/48cb9f03-7354-444c-9123-3fa2a42062c3
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.31 Win 32 Exe x86
Link:
https://app.malva.re/file/ec9a864f9199b0d90e53829ddca054ae
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3/
Threat name:
ByteCode-MSIL.Backdoor.Andromeda
Create hunting rule
Status:
Malicious
First seen:
2026-09-02 03:32:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l3a4kenmet3jsu7jaxyhlbxkgdpnyhrjuauppxkp4giek4eobkzq._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/982692e4-3a52-4e41-8483-71f332e5c179
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook adware collection defense_evasion discovery execution persistence privilege_escalation rat spyware stealer trojan
Link:
https://tria.ge/reports/261019-jlsqfazy2m/
Behaviour
Modifies Internet Explorer settings
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3
MD5 hash:
ec9a864f9199b0d90e53829ddca054ae
SHA1 hash:
ce913161d5374b5920b2c6b2f15f8209c4cdcbf1
Link:
https://www.unpac.me/results/7fc49303-7e25-4f37-a58d-a0b6f5166363/
SH256 hash:
130c9f23a7a5ba673219da983e25d4f427f69fd01c6d25c9a37317fd0c8b5019
MD5 hash:
6bd5946c437973bc849cef0d6d77eaef
SHA1 hash:
009144d539abf4935a22c321879a170362bfa94f
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7fc49303-7e25-4f37-a58d-a0b6f5166363/
Parent samples :
b4b38e1c2c99174f61ed28ee6651e492eb699ccb387433a0cf3861a73967706b
bb0e7d8f68274b32a12a3907fe52d5f1beae19a3ba1bd2c0a23cbbcf57fca2bb
fa40373e5a9d2462d48caca66c22f98e65cebe0fe05f81dce42eae9476526673
97ef870406a1f48080539a324094cdb9eae8f41aeafdc8be86f4c4aaa5a4f14e
09eb32938a0f1265b45c4724b1d994fbc6d2b2ad99f0fab17f545c93e2f42693
5893615f14546d40699d75c7e0691db668da21b4039ea1935376eec550faf9d2
3488ae53d1f63964d4f23dbd6e965dd1fa05c49255ec39be46f677b61bc81c79
dcdde603c0d66e1716ef4c7e8596a11d2818c2151b6c440108ff12f079c3ec7d
4ddba4d5600dc9bb4a88be881700c90ddc3fcd84aa8943c7eacd09a6442a3308
056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86
0317391e6f82d4c482d55f13426771f59af2993b8aa0d1244ecf7df1fb05df13
32a186d26a7797d3c68cfec5edb7dc580dfcc3e71523e26b036a3d8a1815a3be
98f8ae8fa4845bf2d2211182a076027c29d1870cad5ddc150155cdbb72089f1d
49d50307fc575983ad4490d97f535d857a4b1826dd751462d722d22c68b5f8d0
92983d9ec7cbe89ec118ad1757e66954a67912a6332575e8bc65d9b7ad88d4d1
5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3
85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65
ff5bb9669cc476cdb2d6a61e628d475f8839de65661e36704d8c2a569db0fdc3
SH256 hash:
813d4cdefa31fac44121eeb9ae620ca7c28a958f952ddb045e3e53b13f46ef82
MD5 hash:
b9f3f7b47da159887b9b53e2096d01fd
SHA1 hash:
c1f543f499d048f2d052be468946c1d9c37c02ad
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7fc49303-7e25-4f37-a58d-a0b6f5166363/
SH256 hash:
36500b0f2b866bd24d12dbebb610cf13571663c06732e122e1fc6509ac1628d4
MD5 hash:
cffc2338934cb74e917e20b794f6fb6d
SHA1 hash:
a756404e1d5cc6c804b2003a099917d6a064db6f
Link:
https://www.unpac.me/results/7fc49303-7e25-4f37-a58d-a0b6f5166363/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5ec1c511ac24/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/92674/

Comments