MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb
SHA3-384 hash: a6427710654066f4446ade3f2f58baabe1f1e4ebf0aee625a7eb3c2015121e31dbd13ac22ed00e9829b0773f3f527420
SHA1 hash: e21f145bdf3ed72b366589089579b7d534a20ccf
MD5 hash: ba21448713ad273dc89a27a0d589bb03
humanhash: may-oven-uranus-pip
File name:61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb
Download: download sample
Signature Formbook
Create hunting rule
File size:766'464 bytes
First seen:2025-07-07 14:04:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:eC0UxdmERzdllX/Vcelwxzx554BEDFVlq0RJh3rh0OqLF+/3nfHco0m+fVw+2aNk:eC0UnRjedx554BEDjddhTqM/3f8P2
Threatray 3'979 similar samples on MalwareBazaar
TLSH T1BEF40115739BD803D8FA83F15670D2770BB76E9EA021C3468DE5ACFB789279024962D3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
25
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12724/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686bd42c900df8e7f8683d15
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/686bd42a469cec4249ace6d9/reports/4667803c-3c45-4ddd-9d46-5f5530878f40/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/677cf150-1d37-4853-a2ec-37c4dae13bcb
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.01 Win 32 Exe x86
Link:
https://app.malva.re/file/ba21448713ad273dc89a27a0d589bb03
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb/
Threat name:
Win32.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2025-06-18 06:58:12 UTC
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=me2s5s5imxgtn5ztfuvuxie6dzzee55lspaifvmrk3b3qbz2sw5q._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb
Formbook
7d6248b79e83e710efc263a60b855854648088ea196e3460aece7f3fef4dbc8c
Formbook
d6a676ac2fedead7999ed8250543e38da6096cc6efd3c7517d49d6b090ffbec2
Formbook
dfb8ecbf4f52efbf20605c2be946d62bb062edf1dce896a9b45516c7aa90e422
Formbook
error
Formbook
+ 3'969 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/250707-rd4fzasqt7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4c4ce70f-7a06-4ecd-a5ed-a6b925cd5e5a
Unpacked files
SH256 hash:
61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb
MD5 hash:
ba21448713ad273dc89a27a0d589bb03
SHA1 hash:
e21f145bdf3ed72b366589089579b7d534a20ccf
Link:
https://www.unpac.me/results/d8d9becb-d4c3-4a44-b629-ac823aeaf7eb/
SH256 hash:
d51995a17ac347decd96986ea5d9c947640fa00afbdf713b4a60a9788ace210d
MD5 hash:
3030c553c3a29c0d614f44345e8c9486
SHA1 hash:
34d65cfc37cc9579c860e4e084772caff924b12f
Link:
https://www.unpac.me/results/d8d9becb-d4c3-4a44-b629-ac823aeaf7eb/
SH256 hash:
f57abc21b1a683fe28684df41e824a0309e5a4083d6b3f3224acd9275266989b
MD5 hash:
2ee0357347697c6353896c4d4bc71f54
SHA1 hash:
3ecbe6781fb50b53debdb2ecd1526e09bf734d34
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d8d9becb-d4c3-4a44-b629-ac823aeaf7eb/
SH256 hash:
70f61d5be5b17a39f894d4d914e74c7cc9e0c06b1b7ca83823cd705ce810ac8d
MD5 hash:
895343337bdcd007996eb9d3f26f088d
SHA1 hash:
bba01cdba5c804e4b53e46844fec72aa6e8c4283
Link:
https://www.unpac.me/results/d8d9becb-d4c3-4a44-b629-ac823aeaf7eb/
SH256 hash:
32215e1095a990490f672799778156d0cd5f0c779d71b4c8334c04ad56ec2a95
MD5 hash:
095e625f0fade5a6f3c4a22ea8bc459c
SHA1 hash:
e1a959c03eb0e0d4a8f21147846e0e7ae64cc33b
Link:
https://www.unpac.me/results/d8d9becb-d4c3-4a44-b629-ac823aeaf7eb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/61352ecba865cd36f7332d2b4ba09e1e724277ab93c082d59156c3b8073a95bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12724/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments