MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 19


Intelligence 19 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff
SHA3-384 hash: 348428b821ce9ad8aaecff078a72265fdac6d90612ce189e9c15302248038091efa2ad64c1c8fb58f96bdc4b82a453ab
SHA1 hash: 3181195ea45b7e8ecdd7c2d7346b004220dbe72a
MD5 hash: 406823b0c7f54417216f7d8562d837c2
humanhash: lithium-alanine-leopard-seventeen
File name:Invoice & Packing List For GC E022.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:913'408 bytes
First seen:2025-12-23 00:11:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:X1kn2F0efa03y3/tyOXCJy6kkk1GFCMkM1:XmCDiMOyJyln1GFCMkM
Threatray 2'396 similar samples on MalwareBazaar
TLSH T1EE1512D12E25DB05DCBE07746924CD3863B91E68B420F5E75ED93FCB36A67419A08F02
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter BastianHein
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
CL CL
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fe145b5d-f409-434f-a446-48fafa771bb6/
Malware family:
n/a
ID:
1
File name:
_ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff.exe
Verdict:
No threats detected
Analysis date:
2025-12-23 00:12:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d77a59d0-0105-43a7-8a03-346345ada9be

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/45794/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6949de621f45795757238adb
Tags:
shell virus msil
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook krypt masquerade packed
Link:
https://www.filescan.io/uploads/6949de5ee126b9ff438d4d5d/reports/6865e529-b5f2-4122-b9e2-cf9847d689cf/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-22T05:51:00Z UTC
Last seen:
2025-12-24T08:17:00Z UTC
Hits:
~100
Detections:
Trojan.MSIL.Taskun.sb Trojan.MSIL.Crypt.sb Backdoor.Agent.HTTP.C&C Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb HEUR:Trojan.MSIL.Taskun.gen Trojan-Spy.Noon.HTTP.ServerRequest PDM:Trojan.Win32.Generic Trojan-Spy.Win32.Noon.sb
Link:
https://opentip.kaspersky.com/ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a33b81f8-cba8-4210-8a72-1e62dd9d98ae
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.17 Win 32 Exe x86
Link:
https://app.malva.re/file/406823b0c7f54417216f7d8562d837c2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-12-22 08:57:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vslfa4mmwjys7mnfchbut7bol64fberstuz4cx2nmp7pgeavdl7q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
6ea09c48559f1730cd4e346d3b10791b9a5c9d4adb44079793fbe608b288af2b
Formbook
89c232f0c040e54ae9568871262eadec3164ef6ccd10529792c7b949f98b25f4
Formbook
93d8f58337eb1309d7fadafe6707dde3a7d20d65870d05a689b3c2f264e61193
Formbook
a14eaa9515d8c813ed19729380e8153e776cacf742549290afacdc4bfcf83306
Formbook
d04519a5f28662179a347bfff8fb1a96984b9019d097cab9d6903069129370fb
Formbook
db603d2938218ca0b95c604a319858d625907401a9317fafce65d916c7858347
Formbook
eb69376e8cbc70007583ae4283dfba5451d44047c8f95a2a9fd12d81cdfe6062
Formbook
f239532b415d0769dea6827221c226555e1c4bda21ecd050041d829021c52d52
Formbook
+ 2'386 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/251223-ahcelszlas/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4aaca870-67d0-42bd-a822-9ea5f7f5fbc9
Unpacked files
SH256 hash:
ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff
MD5 hash:
406823b0c7f54417216f7d8562d837c2
SHA1 hash:
3181195ea45b7e8ecdd7c2d7346b004220dbe72a
Link:
https://www.unpac.me/results/9597dcd1-2a46-40f1-9210-b136e4c3605b/
SH256 hash:
a24ebc50c6ad99ae2efad2c0c05d4ae3657e21401334e68af512f6baf150c985
MD5 hash:
37af996ebdb1726cf6783e66580626a9
SHA1 hash:
08d3381f5d19b4730915eb616c468e804eb81a6c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9597dcd1-2a46-40f1-9210-b136e4c3605b/
Parent samples :
7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab
1ffdf7d60a9ea155e01520d12ebfadbdca8b62d99ff925245c184499b34a75f5
957ab5ff285cb072d03de9cb8438820bde79ce9dfb59400a5b98dd45f6baa50e
1e0df0b7ddd6821d54ecf37db6a67d267387bf56751a8dfc036896b266c2d1bd
89c232f0c040e54ae9568871262eadec3164ef6ccd10529792c7b949f98b25f4
ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff
SH256 hash:
134104ba338055a4acc67e01bdf91a1a7438dcc66fac59c2fbd4b743313cbcc4
MD5 hash:
0c104b10932de9c6f78c2dbf910deb5c
SHA1 hash:
94349cb7d72af02656ea0c75e258226ea34acc8a
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9597dcd1-2a46-40f1-9210-b136e4c3605b/
SH256 hash:
43ee7dc3eb79eebc7e4efde09d071f0738a5600379517c9c089f3bb0ba3b23af
MD5 hash:
cd1c0367b9faca775cd26980baac6c32
SHA1 hash:
d70449eef3c24c8c750d1c58d5aa49f2e15b0a49
Link:
https://www.unpac.me/results/9597dcd1-2a46-40f1-9210-b136e4c3605b/
SH256 hash:
63f9f41e4bc74801ff87165eae4106ab1cdf3442fdb40c5717657f9f7856ee0d
MD5 hash:
ddbbd81fb48a2a6a085782fae72304a8
SHA1 hash:
1725122e5996f63f6081f198418d321edaa66b96
Link:
https://www.unpac.me/results/9597dcd1-2a46-40f1-9210-b136e4c3605b/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ac9650718cb2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45794/

Comments