MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c
SHA3-384 hash: 010c64f8630a0a048671c73ea45a95caa69dc77094a8a140ccc74859fad200f650aa12110d358caae83895a4972c06bf
SHA1 hash: 18d0766838c235c8f818435ba3bd9db354e24620
MD5 hash: 2ae311d7d5b054bd15a031ba76a89c07
humanhash: connecticut-solar-washington-monkey
File name:a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c
Download: download sample
Signature Formbook
Create hunting rule
File size:1'081'344 bytes
First seen:2026-03-06 14:41:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'853 x AgentTesla, 19'779 x Formbook, 12'303 x SnakeKeylogger)
ssdeep 24576:EBqn5guQaVUu0RzmIWaR03VXn40QEf/voHI7MZUreF0XKVict:H2uVVCSaq3VTJYo7//XKQc
Threatray 1'322 similar samples on MalwareBazaar
TLSH T13E351258765BCD23C1A8077255E6C27053F58E88F233C28B9EDE2CEB7746F925A84706
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
NETReactor RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3d1ae411-d5d5-4015-8d08-76c91150db80/
Malware family:
n/a
ID:
1
File name:
a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c
Verdict:
No threats detected
Analysis date:
2026-03-06 15:02:58 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/53d89505-8849-4a65-ad2e-e6533c0d14dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/55917/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69aae7ec002d37d5c984bc64
Tags:
virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
agenttesla krypt net_reactor obfuscated packed packed
Link:
https://www.filescan.io/uploads/69aae79dcd25bfe1dfe28d0f/reports/84aa375a-9b52-431d-93b2-ab6aaae54372/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-12T01:46:00Z UTC
Last seen:
2026-02-13T17:38:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/dfd8870f-b3f0-4abd-98d6-5902af4a3a59
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-02-12 04:29:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=udii24vnmxp3izy64to7nyhept4x6zf53vkrgnjfk2sbnhyixn6a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3c97c9c3fd33f0deafc90dac2192ca8a44a44732368e02fdafbf35da539091aa
Formbook
479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
Formbook
a57580c54c2f959acf8f5207dc07a74f03be4d8598e843b0a5b05f93cc95c9df
Formbook
ac36e1a80e5bce46ba7b0810ee10075cb7fd7c8f0e2603048a8a1e6f0adc7266
Formbook
b32d05c6d0606ae99980ac52e9acbae681e7c35936abca1aa7bbc66bc25bb0e5
Formbook
c516363e147f458e1806ace3348ded638bfdeef92c663a2478940e45b95cb911
Formbook
c9a7422e9bda1f8e36f23648857c16fe5332be73c474503b6502eccf4d5ed059
Formbook
e5f1feba5c6cd56201fd5eb64c4d9dbfae827f756ebbfeda3cb51f453d465d1b
Formbook
+ 1'312 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260306-r2pygsgw8q/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c
MD5 hash:
2ae311d7d5b054bd15a031ba76a89c07
SHA1 hash:
18d0766838c235c8f818435ba3bd9db354e24620
Link:
https://www.unpac.me/results/7ece11e6-2df3-48ab-8eaf-b5b9760262e7/
SH256 hash:
48fa91de316a3b8b9b173548ff297a529e8045cfba133655cb8d7bf2517df628
MD5 hash:
54f2d8dcde429e9fa2c0cef39b6bb0e7
SHA1 hash:
1b0181a02d9f36613fdd5170d1b84a5a8358b2af
Link:
https://www.unpac.me/results/7ece11e6-2df3-48ab-8eaf-b5b9760262e7/
SH256 hash:
810a52b95745ccf3254920ea2d71c921789fd32365d4f1eb28249f602f4109a7
MD5 hash:
f80df8b95af5302891bbcd9bdcb8a23b
SHA1 hash:
3face3682e8b934c0a0d2be14cb7ef814c9a6e0c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7ece11e6-2df3-48ab-8eaf-b5b9760262e7/
SH256 hash:
a7f5d6a88f71d2ce2c20fcfdd015a48a6b92b4d669dc56bd7107297e3bf76f2a
MD5 hash:
b77905280df2068a7574070c767214eb
SHA1 hash:
a0c65e78ea1ca8e60c9d11805affd5a778696ce5
Link:
https://www.unpac.me/results/7ece11e6-2df3-48ab-8eaf-b5b9760262e7/
SH256 hash:
f1acd26fdaae9c6b23416f17e2766fe6af69d47e87350a1265ee0c7ebdf6e15d
MD5 hash:
ad1a52fedd1e8cb0a2014e88a172165a
SHA1 hash:
3c34f46265f49d8e31e77911cd4daacd20f79c46
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/7ece11e6-2df3-48ab-8eaf-b5b9760262e7/
Parent samples :
e5f1feba5c6cd56201fd5eb64c4d9dbfae827f756ebbfeda3cb51f453d465d1b
a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/55917/

Comments