🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c
SHA3-384 hash: 6c0e9dc2439012e963af6bda3c1dd9e7bf2370eb8d6c46132b5511025bd88884a380de60ffa323802e35dc16eaf26a38
SHA1 hash: 03e451291906bb915fa797d94e8058c4db84357a
MD5 hash: e344f97fb01b87c90e275d2f367ed0fd
humanhash: one-five-finch-ceiling
File name:a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c
Download: download sample
Signature Formbook
Create hunting rule
File size:1'178'112 bytes
First seen:2026-08-10 14:15:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'315 x AgentTesla, 20'732 x Formbook, 12'404 x SnakeKeylogger)
ssdeep 24576:GV/jLDh75WximT0hJoEHQno/7ZU6XL0UFp8BgqW6aV:O9QximT0joOQno/9X0UFj
TLSH T17A4512507210D61AD48527384AA0F3FA02B95EEEE901D71BDFEDBDEB7839B024918753
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 3e73715d4d5d7d23 (62 x Formbook)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3acbacee-1eb0-4819-84ca-7ad73fc42efc/
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/79790/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac1a299d717b5d14242d474
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
explorer lolbin packed vbnet
Link:
https://www.filescan.io/uploads/6a79dd8d5ca504a8496e1c71/reports/0e67cae1-06db-48e5-ac3a-3d17321f78f4/overview
Verdict:
Malicious
Labled as:
FormBook.Generic
Link:
https://www.hybrid-analysis.com/sample/a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-12T22:29:00Z UTC
Last seen:
2026-08-10T21:26:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f82a4e2-189a-4458-ac3d-476710271197
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-07-13 01:17:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
25 of 36 (69.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ueeljg56dqskio5e3wttgatd6avn7qrofvdf22ud3qpo2cxxffoa._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260810-rltxhagg45/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c
MD5 hash:
e344f97fb01b87c90e275d2f367ed0fd
SHA1 hash:
03e451291906bb915fa797d94e8058c4db84357a
Link:
https://www.unpac.me/results/9c575492-42eb-4e6d-abbf-60d073053811/
SH256 hash:
7a09d4c71af5d34d449fc0ba91c8993492828bc5d6a1a3300c3f27df63c56e28
MD5 hash:
acbdef84097e8e77e2fa56219b88e479
SHA1 hash:
1d0de023f006931d010e601ff392b6621279ddba
Link:
https://www.unpac.me/results/9c575492-42eb-4e6d-abbf-60d073053811/
SH256 hash:
00593f8d366d191f2f746d3eac780fbb87d9de172e2931252e6f008cfcc47039
MD5 hash:
32dc061429fbba9b35dde1b11ee93529
SHA1 hash:
2b60b58f99581dfcf0250b24a24887b5f1d0bd89
Link:
https://www.unpac.me/results/9c575492-42eb-4e6d-abbf-60d073053811/
SH256 hash:
187bb41803a5c8995c6f087503800f1d2aa070244a338623def3435385d45671
MD5 hash:
8ce31c28d6d82c0036ca5027ae15cb70
SHA1 hash:
be8f74dada183488ab8a47839aabd175c32e95f9
Link:
https://www.unpac.me/results/9c575492-42eb-4e6d-abbf-60d073053811/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a108b49bbe1c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:test_rule_vldslv
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79790/

Comments