MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41
SHA3-384 hash: 468a1efefbb9923a2aea3eb7d49a532de84308631a2dba47d99b2810acb88de32f47b5c5e6cf9ac549cdfd364d60af95
SHA1 hash: 6c98891ab8c3d676ec2c57b4730e3d19a8bc84b3
MD5 hash: 2f720cf92341a9a16422cfe891900f77
humanhash: bacon-floor-football-dakota
File name:9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41
Download: download sample
Signature Formbook
Create hunting rule
File size:676'864 bytes
First seen:2025-12-08 14:40:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:63/bXx/ux/GV7vdVotdMx/JQTw+IGSeGfeLISFnjPpBYjtNpi96irWPkx/:67xWxeVzdyMxRL+3zKjtNpi967Mx
Threatray 2'278 similar samples on MalwareBazaar
TLSH T169E4F050B2A89417CE7856F60C72F6750BF96DDEA910C3E98DC8AEDB34E9F041E00A57
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/663c6e10-826e-4b0e-8caf-21d033678716/
Malware family:
n/a
ID:
1
File name:
9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41
Verdict:
No threats detected
Analysis date:
2025-12-08 16:37:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b6ed9807-1560-4f2e-a0ac-999c83f41531

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43117/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936e3afdb58e1a2c22b8351
Tags:
virus
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-11T11:43:00Z UTC
Last seen:
2025-12-09T15:52:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/08654217-16b9-492a-946c-e28b517ba65f
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.33 Win 32 Exe x86
Link:
https://app.malva.re/file/2f720cf92341a9a16422cfe891900f77
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-11-11 15:21:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tya3khz72pibt22sfn3zjo4ea7cd3bkfd7nkieyfpgcbmagmjraq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
formbook
Create hunting rule
Similar samples:
23992ab41872ac21dcd499a48a743e51afa43d873d8564a95f03f4a639d3bfbc
Formbook
3f1bebc7b0ea5164074e72a8f77e3bc133d1d415f5db79c20385b8d5a601a1a0
Formbook
5ce77e84e2cd14e6127858e392fdc37d53bc87a5af9f9321cf7d336c18c10b03
Formbook
617bf6800d42409a74ae0539d3e3ffc412e6c4bb137c232159c3ca946bc0fcdd
Formbook
62641672222e838c59836451c910b29233433eb80581fc7f3672de2b6a33b365
Formbook
94976e161177276c6c1f03697f87bbbda781fedb937342a311728f51a3bce501
Formbook
94f3a5b7cc5784d0be1f7d4c726ea45c5c84a132f7b86a10dee5d63332c5415a
Formbook
aebe8d0e01c9c905de67582daeb2dd28854f33dd41825fd78824a30fc018d499
Formbook
ccc0b9b62c26f70e3ef5559b35c531e2b2b049b9da0b2275f0f6e5d0801ba0ff
Formbook
error
Formbook
+ 2'268 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:gb52 discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/251208-r2nenawqfw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ba07de6f-f239-48bc-a9fe-6d1eefed34d0
Unpacked files
SH256 hash:
f1e4d39b9ed801e08650caf5b7611cdad30cc193a7c9cacb0f15276dda3ee713
MD5 hash:
8bec2fe93faac6a90bd46058957e386b
SHA1 hash:
360a9032cf35d6675ba62bfe22dd25bfd39732e8
Link:
https://www.unpac.me/results/68c7d599-292b-466a-b6e7-63518711517e/
SH256 hash:
3682b0741594db47ca57196e720c1eb3d09bd541b82b9bfad8bcfa02fa66154d
MD5 hash:
64fb62c92a74fee594f3bfbc7a97d525
SHA1 hash:
66a437b87c5f3b6f3c4c89ed05170c7689ed947f
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/68c7d599-292b-466a-b6e7-63518711517e/
SH256 hash:
ebf3173661c3805fe0aa1c6abf21f3519c8d3e4e017ebff1c8b65025651e8bfb
MD5 hash:
27599777fa32123bafaf48b3e2511d0e
SHA1 hash:
ead8a61dc554fbc5b5b094d7e5a35aa4ce9c1f6f
Detections:
win_formbook_auto
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
FormBook
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Formbook
Create hunting rule
Link:
https://www.unpac.me/results/68c7d599-292b-466a-b6e7-63518711517e/
Parent samples :
aebe8d0e01c9c905de67582daeb2dd28854f33dd41825fd78824a30fc018d499
5ce77e84e2cd14e6127858e392fdc37d53bc87a5af9f9321cf7d336c18c10b03
9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41
8dfa6515ab3df482f4c286932feec38420e606c8bb42e2055f4361db4fc638b9
22f10bf1295ad52d5b60b249cbb144fe1dade77c578e50a63991dac312a7b21e
SH256 hash:
9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41
MD5 hash:
2f720cf92341a9a16422cfe891900f77
SHA1 hash:
6c98891ab8c3d676ec2c57b4730e3d19a8bc84b3
Link:
https://www.unpac.me/results/68c7d599-292b-466a-b6e7-63518711517e/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9e01b51f3fd3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43117/

Comments