MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32
SHA3-384 hash: 2887b1932304326f0e3a21e4fc1fc08da726c4d4e3190fb884c8a2bdf4f8b4065ee27614bbd8502119d3a9490479a1c5
SHA1 hash: bf77af177439ae81a7c7567eebb48717c52cce45
MD5 hash: efafa1e44a6957b1f208231e941a0578
humanhash: neptune-harry-venus-october
File name:7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32
Download: download sample
Signature Formbook
Create hunting rule
File size:741'376 bytes
First seen:2025-12-08 14:49:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Lt0f/1P1sgDjyoFWWF/AXZ+tGRQHnPTD8BXAdTzEYuIsvJ:L+TsgDmo0W1AXZGYQHKX0nEYuz
Threatray 2'221 similar samples on MalwareBazaar
TLSH T1B5F41245671EDE12C0922FB09D60E2B557788EE9A425C30B8FDF7CEFB86A30599813C1
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
FormBook RoboSki
Details
FormBook
a decrypted component and its RC4 key
RoboSki
a Base64 + XOR/Sub-decrypted component, its associated key, a mutex, a filename, and ReZer0 configuration parameters including: a load type, a download URL and filename (if configured), an interval (if configured), and varying flags
RoboSki
an extracted ReZer0 payload
Link:
https://research.acce.ciphertechsolutions.com/results/80c83ef1-255c-4c64-ab36-ca3c56280c4e/
Malware family:
n/a
ID:
1
File name:
69146f8f-00000004-f7467e67.eml
Verdict:
No threats detected
Analysis date:
2025-11-13 14:01:01 UTC
Tags:
attachments attc-unc susp-attachments arch-exec
Link:
https://app.any.run/tasks/36bf21c3-4dc2-45a7-a62f-ee04ed38d08c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43192/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936e5d4db58e1a2c22b8564
Tags:
snake virus micro msil
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-12T01:13:00Z UTC
Last seen:
2025-12-09T06:42:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/65bfabb6-ef43-4bcd-bad2-ce16b94c6184
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.31 Win 32 Exe x86
Link:
https://app.malva.re/file/efafa1e44a6957b1f208231e941a0578
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-11-12 09:15:30 UTC
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=polmb5fo4s73ixvstpteuxkgtljsiejnv2g4lru2zttjktwdhmza._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
33e3c3bacfaf4035d13503a8855e5f1c17b5801ea988e72e2bb939ab58c12f39
Formbook
52bd274cd1b0ada7597a4d72e78190d7b5574f0819204b4a3c0ac488256533ed
Formbook
6a64a490df8bbc5569f98983a51a8383e8f6077c93af36c76a6d5c194ff8e5b3
Formbook
8ec0ad44c95b1b7190a2fcae723d0189bc0c814e08244b974c0e9fe51b19bd03
Formbook
a4e1ceb8458e0bca4119adb33ded5b1ef154f0ba69594b2079fbbcfb48cbe4ce
Formbook
b36a6dea23c15e5783122d763255c950ee1390c603c7f2c1f12ef3b3a0bf032a
Formbook
d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638
Formbook
e97f62d893c2f818f623482a0c8f35f32e9862a67cc479efdb5723ec75d1f6c0
Formbook
ebc963782a30a3e6cc360a6e4fda16d2acac2de13ee0d8db863082e699dabd5a
Formbook
error
Formbook
+ 2'211 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/251208-r7w9rawrfs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/932543c8-cdb9-4a72-a64a-32f49d132338
Unpacked files
SH256 hash:
7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32
MD5 hash:
efafa1e44a6957b1f208231e941a0578
SHA1 hash:
bf77af177439ae81a7c7567eebb48717c52cce45
Link:
https://www.unpac.me/results/b412a16e-33b9-4e82-9506-11918ff35bbf/
SH256 hash:
4755144f82a4a3fa80f43be3df88153647eb21497ca3dc4f025a1153053decc2
MD5 hash:
39274f692cae5cf33932f90258e4ad98
SHA1 hash:
054a3ecaf8abe838fe52a229bbba1a2755456653
Link:
https://www.unpac.me/results/b412a16e-33b9-4e82-9506-11918ff35bbf/
SH256 hash:
079f1dff2961325a3476c64504ffcd4d878d13b54717f8810258d368a97985de
MD5 hash:
cd9b1f48cd03880d3fc612a29cbc6450
SHA1 hash:
af47ec6e1c1f25ce7ad52c8d527fdbf2bb60cc1f
Link:
https://www.unpac.me/results/b412a16e-33b9-4e82-9506-11918ff35bbf/
SH256 hash:
5a437a18e97884909956fc6a34a2e5e8dba9ad1eef8b5e3d494d2a5c6109cd4b
MD5 hash:
7c01d0c6794f7a4411eeb73135080e02
SHA1 hash:
de6697eaa1d524cd625b5aed5dc69b5d3fc1cd43
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b412a16e-33b9-4e82-9506-11918ff35bbf/
SH256 hash:
ce094da9b78dee89b183b436b1f08b666b90d9729e4dd0121c0f5261f8eeee67
MD5 hash:
01fe58cf248420d4a9e26d26d68b00a9
SHA1 hash:
322547b41c7d1d1dd1f976a7c95103be0af6a48a
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/b412a16e-33b9-4e82-9506-11918ff35bbf/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7b96c0f4aee4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43192/

Comments