MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d
SHA3-384 hash: 85a4729c8938bf421ae0729b34ecb3bf6ba99a0595d89990b345c1c05a77e37904d8b7486977c18ebf16767974400cc5
SHA1 hash: 2f449cc7bee31097752713bbce6b35fe58c7c2a4
MD5 hash: 8b599b20852c6d8773212f5cb74b9636
humanhash: maryland-berlin-william-lion
File name:SecuriteInfo.com.Win32.MalwareX-gen.52425749
Download: download sample
Signature Formbook
Create hunting rule
File size:779'776 bytes
First seen:2026-02-13 08:23:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'853 x AgentTesla, 19'780 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 12288:l/2RsFxzhnR+GBUkaf/FJKR0fKl41qnuMLYZ9JwwCYei15/hEAERY/:lhF3nRdUvf+qKlw0Mei1DEAEy
Threatray 2'715 similar samples on MalwareBazaar
TLSH T10EF401997349EA02D5F25BF00C70D3B017B8BE8E6822D30A5EE9ADFF78347506955782
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
FormBook RoboSki
Details
FormBook
a decrypted component and its RC4 key
RoboSki
a decrypted ReZer0 component and possibly a decryption component
RoboSki
a Base64 + XOR/Sub-decrypted component, its associated key, a mutex, a filename, and ReZer0 configuration parameters including: a load type, a download URL and filename (if configured), an interval (if configured), and varying flags
Link:
https://research.acce.ciphertechsolutions.com/results/9ef204b0-fcd9-4d26-9e7f-0816b1bfefb1/
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.MalwareX-gen.52425749
Verdict:
No threats detected
Analysis date:
2026-02-13 08:48:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e488387e-f50f-45a5-9007-0332748ec296

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/53202/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.52425749.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698edf821c4b7b977f661b85
Tags:
virus
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-18T03:12:00Z UTC
Last seen:
2025-09-19T04:48:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2c3dcf53-2461-420f-8f3e-c999e59802be
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.44 Win 32 Exe x86
Link:
https://app.malva.re/file/8b599b20852c6d8773212f5cb74b9636
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-09-18 10:09:26 UTC
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qqrviz2a55c7wzyta5u3wqmaoqievuq4wullu6cf2eoyasomvnoq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
3167dcbb0fa3b1547f03510333141df87db2ad06324b388e0ce59b73d7e4c5f0
Formbook
5d33c27d8d34e9b82c5ade1de375c88ade2a58b11494d803040b05f1569bf22a
Formbook
8b5a285d51d9d4aaebe88da69d1c22612063ec19476c3b0a6c6838fb69fcb375
Formbook
9037c923df1785d5acc630ddfd5155b30abac35380613777e123fdd8fd5d2028
Formbook
9112615ba411d6052895da2d4a276289c21a36e2ae4ff93634d9d207f5e75427
Formbook
b871c4250ae38356063d8cb37ab609a76d3c8ee0bd1eb2eb9d971d79853f29ae
Formbook
e1f829fbc77d8e8fae1e9d80b813602a97bd0b9bb622ed743d24580d2bdad892
Formbook
e5c0d94c239bbf3aa57e92fd08403967b62ae2eaba19d1acc40400d4a1050cb0
Formbook
f10f6ed74b4c3c9629c9dfbcb999b191dc9a8ddc14fd0065c5ae51e68da33363
Formbook
+ 2'705 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260213-j99zmagv9b/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d
MD5 hash:
8b599b20852c6d8773212f5cb74b9636
SHA1 hash:
2f449cc7bee31097752713bbce6b35fe58c7c2a4
Link:
https://www.unpac.me/results/dc2ebc44-b8e8-4a35-9456-fdf3888d87c0/
SH256 hash:
07827b713fe8fa6d79b66de8e2f092cec90984083ed13ae0d910a17e27449b3d
MD5 hash:
42b7e3c75356a73b41035ae3f6d5c0b2
SHA1 hash:
02d54e37af1e3439cbd62b531ef2e5c2314eea2f
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/dc2ebc44-b8e8-4a35-9456-fdf3888d87c0/
SH256 hash:
1041b538ccbc7d66e59247ef7551cde9b6c282843541585e9190a8e2e3943b12
MD5 hash:
e870d1e8f3791ccc141f85f40fd2972b
SHA1 hash:
150919ee289cffa6feb40ab8261f620dd7e26aac
Link:
https://www.unpac.me/results/dc2ebc44-b8e8-4a35-9456-fdf3888d87c0/
SH256 hash:
1b61f9edcd7ce9b65cb95a9cdc20023f15eecc475669c06adcf965d43ee552ec
MD5 hash:
4911237feed2d7d142fcab04878f8a06
SHA1 hash:
1e6a2fb1dba79dcf8b7d22e7653f6bce69c77ee4
Link:
https://www.unpac.me/results/dc2ebc44-b8e8-4a35-9456-fdf3888d87c0/
SH256 hash:
f4648da45f3bd7eb1065746e86e04f70200e04b07cca5b0a9bd943a5aa87a052
MD5 hash:
3458446c943906e897d832f2a7595efb
SHA1 hash:
47fc07b32a09dff8c5d46e730d5e41b3be8f6942
Link:
https://www.unpac.me/results/dc2ebc44-b8e8-4a35-9456-fdf3888d87c0/
SH256 hash:
8bc027757a422fb334c63350bc79488920d7e78fa7398c72934b978df410215d
MD5 hash:
42e2f326335ce5bb45607fbf606e344e
SHA1 hash:
a4e02f471abf8b8abc4a1993c232600e662500d9
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/dc2ebc44-b8e8-4a35-9456-fdf3888d87c0/
Parent samples :
bc16ea0319477e9b3f88c99b56dc71baf4f7f21d69274f391362f37fb763cf19
c387e0b0e9f50043143b28faf9c15058689c2b3e7f9fb533e3b2f2be3ad95a0b
dcb691b089fa29be68bf87b37c40b0ce085b8c406eb78ce8e80ec80bf524f1e3
1f116fc881ebc63e82da31c51e4748961f138b2b8f83f948c6605282135ea6e7
f1f024ecf670402056cb215338dfbb8de5c25671f9e5e127b9df197dc972bac3
a1aac69e61fbf0ab4f4d04092f73857d04743117f74b0b78dddc0c382659390a
62016848b8c42b05e7e94628f567892628da294cf4b2bb35c7ff9ca4e7369715
f980f36e53756a9a63992d61749e45842f2e2a2a23b297c886dadf41a3b01e9c
9037c923df1785d5acc630ddfd5155b30abac35380613777e123fdd8fd5d2028
7a5c911064b8a4ec0d503c16a16ee46f974fdd35324c9dfe4cbb7cc537686fd3
cf938a9c9c24de96809b43ef00e50547a13d0abbb5fc360c33c93d6a69a2c688
8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8423546740ef/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/53202/

Comments