🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65
SHA3-384 hash: 81922e28e858be6311be21be53b0c408ae5888785415cad6ea256bd2e3f6f1d3e22d170a2ae3ac8bac0271de9f9c5d3f
SHA1 hash: f23782e7f4c14b2dde7a4c61c226d5d59e376c5a
MD5 hash: 51a184ab8d5473f876d6f48991134ae5
humanhash: xray-kilo-earth-lactose
File name:85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65
Download: download sample
Signature Formbook
Create hunting rule
File size:1'153'024 bytes
First seen:2026-10-19 07:41:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'288 x AgentTesla, 20'697 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 24576:b1j2gM2WsXrBL26dPkwmq0F3wlMio6gd7H8nhtPcElJ8HF:b9vJTbFhPkBJF3iglaht7lWF
TLSH T1E63502142219CE03C4BA5FF01971E2B41B795EDAA952D217EFEABDDFB9BA7001405383
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c0174b05-14a2-4555-898a-0317053a54fc/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-19 09:01:29 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/2d5a617f-8107-4317-9189-26848f3d24d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/92675/
Detection(s):
SecuriteInfo.com.Trojan.Inject7.2544.30343.1941.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad5d3765a22ac805bd7d9f7
Tags:
virus micro cupi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-01T05:47:00Z UTC
Last seen:
2026-10-20T18:34:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/04d5e74a-8a1c-44ca-b03f-1c1a1e7d5b21
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.31 Win 32 Exe x86
Link:
https://app.malva.re/file/51a184ab8d5473f876d6f48991134ae5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-09-01 20:55:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxcdwof23tlqqn4d7g7ej62nod6u2pa63k2bvuoqweg6kaaurrsq._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/8244a696-515d-4ce3-81fd-0a1c09384af7
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/261019-jlsqfazy2n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65
MD5 hash:
51a184ab8d5473f876d6f48991134ae5
SHA1 hash:
f23782e7f4c14b2dde7a4c61c226d5d59e376c5a
Link:
https://www.unpac.me/results/5d9a336b-7851-4ecf-83d8-10e89eda4674/
SH256 hash:
130c9f23a7a5ba673219da983e25d4f427f69fd01c6d25c9a37317fd0c8b5019
MD5 hash:
6bd5946c437973bc849cef0d6d77eaef
SHA1 hash:
009144d539abf4935a22c321879a170362bfa94f
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/5d9a336b-7851-4ecf-83d8-10e89eda4674/
Parent samples :
b4b38e1c2c99174f61ed28ee6651e492eb699ccb387433a0cf3861a73967706b
bb0e7d8f68274b32a12a3907fe52d5f1beae19a3ba1bd2c0a23cbbcf57fca2bb
fa40373e5a9d2462d48caca66c22f98e65cebe0fe05f81dce42eae9476526673
97ef870406a1f48080539a324094cdb9eae8f41aeafdc8be86f4c4aaa5a4f14e
09eb32938a0f1265b45c4724b1d994fbc6d2b2ad99f0fab17f545c93e2f42693
5893615f14546d40699d75c7e0691db668da21b4039ea1935376eec550faf9d2
3488ae53d1f63964d4f23dbd6e965dd1fa05c49255ec39be46f677b61bc81c79
dcdde603c0d66e1716ef4c7e8596a11d2818c2151b6c440108ff12f079c3ec7d
4ddba4d5600dc9bb4a88be881700c90ddc3fcd84aa8943c7eacd09a6442a3308
056cf40663f940ff70165d74ea4380e12ab3d7a92be7c820c902f9bcfbf5cf86
0317391e6f82d4c482d55f13426771f59af2993b8aa0d1244ecf7df1fb05df13
32a186d26a7797d3c68cfec5edb7dc580dfcc3e71523e26b036a3d8a1815a3be
98f8ae8fa4845bf2d2211182a076027c29d1870cad5ddc150155cdbb72089f1d
49d50307fc575983ad4490d97f535d857a4b1826dd751462d722d22c68b5f8d0
92983d9ec7cbe89ec118ad1757e66954a67912a6332575e8bc65d9b7ad88d4d1
5ec1c511ac24f69953e905f07586ea30dedc1e29a028f7dd4fe19045708e0ab3
85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65
ff5bb9669cc476cdb2d6a61e628d475f8839de65661e36704d8c2a569db0fdc3
SH256 hash:
112d8d5b1bc0d26bc24a7ce3458f6797836cf16e9d8a292c79f7ba43450f204e
MD5 hash:
f5ec1ecbf5a3675391dd9b3237210ce8
SHA1 hash:
382a3f945f6a66545fcff09e58b13155dfe2ad1b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/5d9a336b-7851-4ecf-83d8-10e89eda4674/
SH256 hash:
b255e7dfcc5025db999f5044a6795bf846d8ede449a24ce960719da81bf06dfa
MD5 hash:
d001abc600e23b5d1c8f3fa4a6b99597
SHA1 hash:
a93f05121759e25a82e68df9db84a1a7eda1e810
Link:
https://www.unpac.me/results/5d9a336b-7851-4ecf-83d8-10e89eda4674/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/85c43b38badcd7083783f9be44fb4d70fd4d3c1edab41ad1d0b10de500148c65

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/92675/

Comments