MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97
SHA3-384 hash: 86bb391c86dd6754440841585963af8d652d7d7b9fa37326cb84cad7ecd3412b573d9ed92b797e2379040664bdcd4147
SHA1 hash: 722f59c43a852b3048b37aeeb697d79d37b241ab
MD5 hash: 825b9106b52c0c6c66d1f852f7a870ce
humanhash: batman-mexico-carbon-earth
File name:858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97
Download: download sample
Signature Formbook
Create hunting rule
File size:762'368 bytes
First seen:2025-09-19 10:00:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'657 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 12288:+QIV5dbAVGMh9WMCw5mgR7H6ISSlJ/k2M6NEr+BJdF6b3/OoP8Tx3DzdPARJ:+N5dbP3LwHZH6DSlGh6NE8JdC3zPUFYv
Threatray 1'313 similar samples on MalwareBazaar
TLSH T175F40124222ED906C5621FB51A32F2F41F6C6E98F452D207CFD97EEBF53AB505885382
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter JAMESWT_WT
Tags:exe FormBook gooder-bar

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97
Verdict:
No threats detected
Analysis date:
2025-09-19 10:20:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/282c2037-a320-4eae-be98-878cf8a53afb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28319/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cd29f0246a2631bd3105f3
Tags:
virus
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/68cd2b10dc1cad370d1df132/reports/2a89c25e-a7fa-4b8a-880f-a748e372e6d3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-09T19:44:00Z UTC
Last seen:
2025-09-09T19:44:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/812c652e-1c56-485a-9367-278ba6dffaee
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.43 Win 32 Exe x86
Link:
https://app.malva.re/file/825b9106b52c0c6c66d1f852f7a870ce
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-09-10 03:12:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
046ca2dc433d9474ce7222ad4f6c0aa89a3caaab42e6c3c76f260a6c2ff241c8
Formbook
5b50cbb52c090dd0bddb9d9cf1801147fef289051354e618344e27a1375c63f0
Formbook
674b492473c8055decf69d41cf511912178127b104a0aac346770cc919aff31a
Formbook
adf8f2572d50a7af9af7512742520644479904c5973cad6aafa5b6e83516e36f
Formbook
cab82749acbaf6bab5ad3c2bb077bac408ae9d1e798e54b8599ca2ce12c88311
Formbook
e087ef304badb09dbb8b38a88337c5e2d4a0d3fc174d75817e622fdd8f5a6722
Formbook
e1fe0b9026bf4452a4f6d0a21af6c38e151fe5f1a8c6b547074798c25915456f
Formbook
error
Formbook
ffc8f79b6654ee83f5afac0fa12a5eeb666dc73b11d05c7fba51e7acab5928de
Formbook
+ 1'303 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/250919-l32qsaywgx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ee8c2540-f46b-4860-9f50-fc91e30c6d27
Unpacked files
SH256 hash:
858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97
MD5 hash:
825b9106b52c0c6c66d1f852f7a870ce
SHA1 hash:
722f59c43a852b3048b37aeeb697d79d37b241ab
Link:
https://www.unpac.me/results/b192c0d5-fcaf-4d76-a000-490bf542aab5/
SH256 hash:
12dda0cd3b378fbced3071df357733426bb09e47c31fcc3ba6273650f67895dc
MD5 hash:
773c55854eb467033abb78bc2b667f80
SHA1 hash:
54bfd694185cd257abb4ee6b477dba12b971b9b9
Link:
https://www.unpac.me/results/b192c0d5-fcaf-4d76-a000-490bf542aab5/
SH256 hash:
8b3071acfcd603427e77e2988aeab4b1b7beeb98aa7905492cc807d5b34f55e3
MD5 hash:
63988c6943c3d92c51fffec221b47d35
SHA1 hash:
65b403e0585bd943820eef236754688ef8e827a0
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b192c0d5-fcaf-4d76-a000-490bf542aab5/
SH256 hash:
f50e93629149f9e087c481012d2cc5c93e244d21d9ab8ff05e05d5d1ee4b5d90
MD5 hash:
77f578cdc203c9691d971f6139fe8ace
SHA1 hash:
855c0d49c41917f5c1491ffca1f8850a4f113da8
Link:
https://www.unpac.me/results/b192c0d5-fcaf-4d76-a000-490bf542aab5/
SH256 hash:
880e363ff3999fbaa65cc3a7c5a41be2592b7f61d1d4018a1301aa323c2a9f94
MD5 hash:
bda0f964a6b4330eeb5ddf700657c69c
SHA1 hash:
62febeb7b2d868cb51712d14447145cc156393c9
Link:
https://www.unpac.me/results/b192c0d5-fcaf-4d76-a000-490bf542aab5/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/858533276fe2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/858533276fe2058efd23b93879c692facaf413579f528c248b3b1be66b4cca97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/28319/

Comments