MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 19


Intelligence 19 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026
SHA3-384 hash: d7961ec7b6dca5169d976a47c8a695111d7fa18b9b035a13c905a96b44adf04d54eb84a7823aaa5b02e17096bf8ae7e8
SHA1 hash: 2c4f6adb00fd49552d2e7030ff255ad3bd6b97dd
MD5 hash: e8c3cf465dcd453a10cea3158132ffb0
humanhash: vegan-november-oregon-dakota
File name:SOA_October.2025.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:760'832 bytes
First seen:2025-10-15 20:38:36 UTC
Last seen:2025-11-06 10:40:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:i0OTMfw9E5IZJ+j7Ee9O7NcqBswugRV9tOxgKXYEtz69mskoUqxZWdCJkGmD:vfwJ+0RN3T99CXXv69JkYk5D
Threatray 2'207 similar samples on MalwareBazaar
TLSH T117F412682500EB1BDC6597B81A71E67D033E5DDEE410D2266EE87CFBBAB9F001D50683
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
155
Origin country :
US US
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
SOA_October.2025.exe
Verdict:
Malicious activity
Analysis date:
2025-10-15 20:41:22 UTC
Tags:
auto-sch-xml formbook stealer xloader
Link:
https://app.any.run/tasks/263d2a26-719e-4c22-a53f-685751041aa9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/32964/
Detection(s):
no reply from clamd
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f0068a04e22ce9acda83a6
Tags:
virus krypt msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/68f0065464833d0cfabe207d/reports/8354a26e-f50b-4be4-a16a-49b8e761c728/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-15T11:38:00Z UTC
Last seen:
2025-10-15T20:48:00Z UTC
Hits:
~100
Detections:
Trojan-Spy.Noon.HTTP.ServerRequest Trojan.MSIL.Taskun.sb VHO:Trojan-Spy.Win32.Noon.gen PDM:Trojan.Win32.Generic HEUR:Backdoor.MSIL.Remcos.gen Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb HEUR:Trojan.MSIL.Taskun.sb
Link:
https://opentip.kaspersky.com/65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/565d0d28-be2e-496d-afa1-da48f5f96bed
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.37 Win 32 Exe x86
Link:
https://app.malva.re/file/e8c3cf465dcd453a10cea3158132ffb0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026
Threat name:
ByteCode-MSIL.Trojan.PhantomStealer
Create hunting rule
Status:
Malicious
First seen:
2025-10-15 16:53:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mukavyw52hqz4pon3afnhnv5muxhhcbtjyn5drjgjbvbfms56ata._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
3103bad7a756dbde298af3162f848f2a3101354148fec4f4b341a7ce17adf4c5
Formbook
668c1f290c086d51456b3140d33615a6e9fdcaba766966349a4fe33fd37263d6
Formbook
82ba586870ddf21da64398098ac654ae92f389969087698b906d4efe54c6489c
Formbook
87e71f3ca2dfb03fba86134301f3f5d8e0001b6e2668b37bdc6bbdb85fb82513
Formbook
8c9fd9ea38c16b4b38039c60d03c499aff67451f6fcd00d56abd4c81a6f2c3c2
Formbook
b27f17a52b7a491a0887307a8e4984f283b8076c1e49d535863068c51758c8bc
Formbook
cb4788741b2c7792c25c956a4c2dab349fed2e93c175cc79c112d6faf95ec8bd
Formbook
decdb74ebd6bcdf8e64941b717e7830a401490f3d37437cc2110afcbc64d6606
Formbook
ee75983f41e1cbcb6571d23f4753b6c361707331e1de552a1c5a6635ff285f4b
Formbook
error
Formbook
f94f36ad5e8746f9b9dd6a23e079d8d12f0e55d49a96c761cba4b9bbde734f04
Formbook
+ 2'197 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/251015-ze3vtshj7w/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/883ba79c-25e6-4266-ab0f-6f569484fe4c
Unpacked files
SH256 hash:
65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026
MD5 hash:
e8c3cf465dcd453a10cea3158132ffb0
SHA1 hash:
2c4f6adb00fd49552d2e7030ff255ad3bd6b97dd
Link:
https://www.unpac.me/results/6b50a397-7e6d-42da-945c-794efe823a44/
SH256 hash:
f823e6e8ca9bd52588534ec40fa9ec2e7e9621e61783aa58a9ccc9dab49b8d85
MD5 hash:
1e52bc0a874392d7af97f59df70c8c3b
SHA1 hash:
202f6ae7d619fb0fd74cf2f6e0fcd54d89f1c0d3
Link:
https://www.unpac.me/results/6b50a397-7e6d-42da-945c-794efe823a44/
SH256 hash:
3fe14b19f1f04ffa5edcad1cfe4815354743fffd3332748fc0abcb196844e3f2
MD5 hash:
aef467e8e6628cd33e0c0f6cbd577b79
SHA1 hash:
3cc2812d144b9b835b144f7a1fbf6fbf958a5246
Link:
https://www.unpac.me/results/6b50a397-7e6d-42da-945c-794efe823a44/
SH256 hash:
904be31e6ea60e71fef767409bfafc8538575b53b3fc031d3e3cce3e23556d97
MD5 hash:
d0b7fe754babeebce2653dc22020dd26
SHA1 hash:
6a43971dc4caff23cbe27492e2c1025eb4c6dbac
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6b50a397-7e6d-42da-945c-794efe823a44/
SH256 hash:
abc2bc6c510c4ac0e07e5f7e8ddf93374fac30c15db98e17c81c427302a01843
MD5 hash:
37f49bccd89bc2c04e10c283d828ed27
SHA1 hash:
34d7e5b817e0bbf31aad5b4269bebca2aa7d72ce
Link:
https://www.unpac.me/results/6b50a397-7e6d-42da-945c-794efe823a44/
SH256 hash:
0259508f3db506efb244e2c94aa50d88b25a514a14d57c9e278b36d6beecc4d0
MD5 hash:
2e6b287312c0477bebfdd43861d2a149
SHA1 hash:
0e86638370ba98db513ebf605b8a22423f3e8a7f
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/6b50a397-7e6d-42da-945c-794efe823a44/
Parent samples :
65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026
6e949357f4dcb358dc0ce30daf7d688490f41fbba41a6368059fccb6b24e5230
d374091cdaf72ea9673f8e9d63eebaefc9315a3511f0194dda15252ebb517c66
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/65140ae2ddd1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 3c081065e42ccc76714f5014a71cdc57e0993d6d594415570066ab8d47bb82f1

Formbook

Executable exe 65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/32964/
  
Dropped by
SHA256 3c081065e42ccc76714f5014a71cdc57e0993d6d594415570066ab8d47bb82f1
  
Dropped by
MD5 40f2de364319c5eb06de571136545962

Comments