MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0
SHA3-384 hash: 54e1707f6132ebf6d0ec80f66e2fc8f80e0083ae1c82da85f644d73ab442e6c3d570a5491f102760224c7171b0d85bf6
SHA1 hash: ecbf78135a6a6d3208629b1a36df71efccd0be5f
MD5 hash: 608d711ac79743ec1d22f375d7ea3448
humanhash: speaker-georgia-william-pizza
File name:7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0
Download: download sample
Signature Formbook
Create hunting rule
File size:1'240'064 bytes
First seen:2026-05-08 12:48:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 24576:NFbal108HXksnHZt65tDKxmN8Uqgo808AwzFMrP72roJ4m6:e108HLHnctmxm/1oX8ZMrPK0J4
Threatray 2'793 similar samples on MalwareBazaar
TLSH T1C245F1532658CF02D4368BF52D23E97017B76E4EB911F2AE5DC22DDF7D25B240888A1B
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon d4e8f0b2f0b2b2cc (2 x AgentTesla, 2 x Formbook, 1 x AsyncRAT)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
formbook
Create hunting rule
ID:
1
File name:
5a4dd5652cf4a27e426cbff790d8ef6ef948adebee478d84db780e245cf71a89.zip
Verdict:
Malicious activity
Analysis date:
2026-04-09 02:30:16 UTC
Tags:
arch-exec amsi-bypass formbook stealer xloader
Link:
https://app.any.run/tasks/2ffdc693-bb56-442c-83d4-6cb41b3687b6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/65154/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.35242.13282.31380.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69d70f376a61012f6ad03ed7
Tags:
shell virus sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Сreating synchronization primitives
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
krypt packed snakekeylogger vbnet
Link:
https://www.filescan.io/uploads/69fddc3286e92bda70247d31/reports/6b11b730-0d6f-48db-8d33-6fca2e794906/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-04-08T21:50:00Z UTC
Last seen:
2026-05-08T12:46:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/791d84f0-a6a8-4fa3-bf6b-d889d80e2e26
Score:
79%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeyLogger
Create hunting rule
Status:
Malicious
First seen:
2026-04-09 02:30:18 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
35
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=okikubertytljq7g7epyfixsilhzhuhao2b5fptapgvsjpxwt3ya._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0035d9424bdee5b512bd3441db4be0486f82a7beb8890713dada7d83e3b7b845
Formbook
4bca6bd300ef6c13ca953027277a9d7b330cbfe02e7003c2c6883d303c1ec388
Formbook
5c0320d2f4ccb84a48c255a3db4057771046db1fb5ee1923354d8518932b42a7
Formbook
82024b293b8ce6ac8394123c88e64a48e9bcec2d70b0dd43b8632e54ee6ad45a
Formbook
cb48a1b95924a62d97e4e2295f168dbe880a08539a2305e95e907865a36c6fe2
Formbook
d05f9fbc29c1c7eead855daeddb8e7014f5ce664a856c8540cf78f6e8b54ebb0
Formbook
error
Formbook
fde78edfa6163f53cba50d7c8214b078dfb569fff8f97f25e063decbb7370787
Formbook
+ 2'783 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/260508-p3w23scy9k/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0
MD5 hash:
608d711ac79743ec1d22f375d7ea3448
SHA1 hash:
ecbf78135a6a6d3208629b1a36df71efccd0be5f
Link:
https://www.unpac.me/results/c2852301-8032-4555-9006-4ec634a9ddd7/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7290aa04919e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/65154/

Comments