MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6
SHA3-384 hash: 540882591f2c7c2fc0668fe07cf907feaff2e680765f995433e58ccd7848070639422f8b46748b1a1d304db8e55960b4
SHA1 hash: 6769355d985bf2f96c4970b054407a464fcf51bc
MD5 hash: fb5830e3ea12e398db4fe1c57defc780
humanhash: skylark-arkansas-echo-fruit
File name:66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6
Download: download sample
Signature Formbook
Create hunting rule
File size:1'055'744 bytes
First seen:2026-02-05 15:11:25 UTC
Last seen:2026-02-05 15:26:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'818 x AgentTesla, 19'743 x Formbook, 12'286 x SnakeKeylogger)
ssdeep 12288:F1dbIAepSwPwriwNP9a4V+REPOi5+eyPtOzfiM159D7r9T8/yZYB9zU5D1CeN2Es:F19ZxwQidDZ+YUH9lHZ49zCT2/n
Threatray 2'639 similar samples on MalwareBazaar
TLSH T1A525020CFA76BA26CA8D0FBB9203211C84F79597E773F7675D9E09D20C25744885EA83
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
DeepSea
DeepSea decrypted strings
Link:
https://research.acce.ciphertechsolutions.com/results/7f773f09-357e-48cc-ac5c-93745e3da440/
Malware family:
n/a
ID:
1
File name:
66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6
Verdict:
No threats detected
Analysis date:
2026-02-05 11:14:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/61394c98-9dc9-4484-a1f9-29b6cc73ba76

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51940/
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6984b35aae5379bb6609c17a
Tags:
stration shell spawn
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-15T09:04:00Z UTC
Last seen:
2026-01-25T07:08:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6/results?tab=lookup
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3445fba8-a5aa-408d-9030-aff22c51c6ac
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.40 Win 32 Exe x86
Link:
https://app.malva.re/file/fb5830e3ea12e398db4fe1c57defc780
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-01-15 12:29:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m3immq7vvib2lnbqhsxrpqji4doagbjq6iw2hl3o3et4xspe6hla._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
formbook
Create hunting rule
Similar samples:
172c3076e5d6bfe9089a1e092d1286e77337bc3680db32539e3a7bf69b7d0560
Formbook
5a721e420c6fc129a198af6fd7458202c574cff68e0b60b4372a8af5767bd2d9
Formbook
66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6
Formbook
7f9d39908a024cc37cdece4ecc8aa724695ee2873d80ed4b1e7f8f8f3ee7ed5d
Formbook
c6aa56afa7a6941d9bb8786b07e192ea996d3a133c992285b58349cc5c204561
Formbook
e4ff62b66b02a6f78870344b002d83ae80391d1cc0b1651085f23f28d41f027b
Formbook
e5f1feba5c6cd56201fd5eb64c4d9dbfae827f756ebbfeda3cb51f453d465d1b
Formbook
error
Formbook
+ 2'629 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260205-slctnaht9e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
9eaf637faa6357fc67f5ad0b6bbc1a49d3cbe4e64c3351939bfc9719a477fc22
MD5 hash:
c3a2a0ce2bbf4c01905cf31027d34aeb
SHA1 hash:
225312e4731eb0dbf81aa694f680309afaa90cf2
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6a444699-1b9a-45ed-a7e3-56028845f634/
SH256 hash:
c41db6fc4a428414790ee354b1860e4a03b57f4b05c3ce6e9a1a8f2c482a873f
MD5 hash:
2bf6ecd02e9448555578129d91667bcd
SHA1 hash:
2d21a969e0f48afbda16e3306d3837e9c99f0fbc
Link:
https://www.unpac.me/results/6a444699-1b9a-45ed-a7e3-56028845f634/
SH256 hash:
e639da93787585df6579da51ec459feb5c230675488bc4834b491a1ca8a48ff4
MD5 hash:
79a00616867a5b05eb0c2d3450a5d5e7
SHA1 hash:
6694e2709bc68fea472d981c3f6badfa2ea1c546
Link:
https://www.unpac.me/results/6a444699-1b9a-45ed-a7e3-56028845f634/
SH256 hash:
38551e7119a33faba6141ae4592ebb01f0b7fe99196313671d5af7d2c1541a42
MD5 hash:
096a95b2870f7d72353626addc112c13
SHA1 hash:
b471e5b6419336c226731c4f9aabaafdc6a9ff49
Link:
https://www.unpac.me/results/6a444699-1b9a-45ed-a7e3-56028845f634/
SH256 hash:
323a1a4a5646bdcb28d8593fce8a3851ffd09bb0ad6c099eb8ab74ba790cbdb0
MD5 hash:
c67f3284ddc7f51eed436405fb08fc48
SHA1 hash:
a1c82dacf1452d820063e2a65ce3cf888ef0d7fa
Link:
https://www.unpac.me/results/6a444699-1b9a-45ed-a7e3-56028845f634/
SH256 hash:
66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6
MD5 hash:
fb5830e3ea12e398db4fe1c57defc780
SHA1 hash:
6769355d985bf2f96c4970b054407a464fcf51bc
Link:
https://www.unpac.me/results/6a444699-1b9a-45ed-a7e3-56028845f634/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/66d0c643f5aa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/51940/

Comments