MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9c25f0e398787875c5d4513495b884b4392df171d8ae8eecc8e32c762f81c63b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 18
| SHA256 hash: | 9c25f0e398787875c5d4513495b884b4392df171d8ae8eecc8e32c762f81c63b |
|---|---|
| SHA3-384 hash: | 5cb3bd80cc4039b562a1c0119673641c1ad2fc9f8f0b37e75161f5a0031c773d55974d6bf1f5759757905ef53d0e9157 |
| SHA1 hash: | 1d3bddb9bfb4b4fea23137261e963e4775af51b7 |
| MD5 hash: | 1d9bb59e9406d7de2b9fff89d0e6f105 |
| humanhash: | five-jersey-magnesium-carpet |
| File name: | CREDIT NOTE-LGPS2025112756D-MADI-EX-WORK.bat.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 719'872 bytes |
| First seen: | 2025-12-26 02:35:32 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:LetMm7d4r6ivB/v6oOCtJP2Nh6/9iEmebZLsrwZlmHW0u4TVVt:E4r60/v3JP2Nh6oeyYQHW0ZTDt |
| TLSH | T162E41265A619D613C941577A4AA2F6B013BD5FD8F401E7239FE87EFF38336461E08282 |
| TrID | 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10522/11/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| Reporter |  BastianHein |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
121
Origin country :
CLVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
CREDIT NOTE-LGPS2025112756D-MADI-EX-WORK.bat.exe
Verdict:
No threats detected
Analysis date:
2025-12-26 02:37:55 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
99.1%
Tags:
shell virus micro
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
formbook infostealer krypt masquerade obfuscated packed purelogs unsafe
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-25T01:04:00Z UTC
Last seen:
2025-12-27T23:46:00Z UTC
Hits:
~1000
Detections:
Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Taskun.sb HEUR:Trojan-PSW.MSIL.PureLogs.gen Trojan-Spy.Noon.HTTP.ServerRequest PDM:Trojan.Win32.Generic Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb
Malware family:
Formbook
Verdict:
Malicious
Score:
99%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.23 Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.FORMBOOK
Threat name:
Win32.Spyware.Negasteal
Status:
Malicious
First seen:
2025-12-25 17:10:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
17 of 24 (70.83%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
9c25f0e398787875c5d4513495b884b4392df171d8ae8eecc8e32c762f81c63b
MD5 hash:
1d9bb59e9406d7de2b9fff89d0e6f105
SHA1 hash:
1d3bddb9bfb4b4fea23137261e963e4775af51b7
SH256 hash:
751cc4f10a665b4f6b29a8656d2b463f7e9a29067ee7c58aed599977cff6edfd
MD5 hash:
e82d48d33717b1c8581120787a110ba3
SHA1 hash:
75f59a7ca06925c649b4a8eb12cdfd47b4f9e4f7
SH256 hash:
43ee7dc3eb79eebc7e4efde09d071f0738a5600379517c9c089f3bb0ba3b23af
MD5 hash:
cd1c0367b9faca775cd26980baac6c32
SHA1 hash:
d70449eef3c24c8c750d1c58d5aa49f2e15b0a49
SH256 hash:
b947ffd27cd168822cbb4e639db2dd765a306505167315b9cea4cc4ae9ab4358
MD5 hash:
95d33cd42987a561465ea8efe86f490b
SHA1 hash:
ef7ee9c81e4e42d3e0c149ca482ec6d72e4ea754
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
6fe730bb2b4d3df9dd5c3c0ef35f5a104993d7760be4235e7290b5050cced62b
MD5 hash:
9f176765ebbe9b9b761c7702b4305e5d
SHA1 hash:
ba7b5caaace02aad5950262cd556c598379075a5
Detections:
win_formbook_g0
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.