MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157
SHA3-384 hash: 7980ac5ceac9e68b4c40387247d6b72125d4598148e3786151bea677f5d81b8c42d34a7c5f49c31655f268f681b5d108
SHA1 hash: e435cbc2299fbeacfaa9bc8d1c678bd71b47c0ca
MD5 hash: bfdf14b4d5c067937e3a76161f99f206
humanhash: oklahoma-georgia-hot-edward
File name:ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157
Download: download sample
Signature Formbook
Create hunting rule
File size:703'488 bytes
First seen:2025-09-19 10:02:38 UTC
Last seen:2025-09-19 10:04:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:ZIOvdKEU+gjTu+TzpC/F3pa6EBxJh16wUUN0/KmYkUcA/WjHEaaqojL4e:ZIkd7qTlTzpC/naTxPdN0SmWcA/2uq
TLSH T159E4124017A5CA02D4A56BF09A32D3756BB69C8EE433D34B5FC8BDEFB936B0405417A2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter JAMESWT_WT
Tags:exe FormBook gooder-bar

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157
Verdict:
No threats detected
Analysis date:
2025-09-19 10:42:50 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/bbc978a6-7eeb-4a53-9ead-12c66403d0ae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28321/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cd2a67246a2631bd310618
Tags:
shell virus msil
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
agenttesla obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68cd2b7c73af424b47e75d28/reports/21a41f8b-3234-4aa7-aaa6-33d1ff37f1bb/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-04T04:19:00Z UTC
Last seen:
2025-09-04T04:19:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3fdd4660-28d1-42fc-b378-170a73893425
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.38 Win 32 Exe x86
Link:
https://app.malva.re/file/bfdf14b4d5c067937e3a76161f99f206
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-09-04 13:33:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2hpl3ktmvg6awrs2fl7o3p33qxhgt4efq5ycxwc55ptp7je6flq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/250919-l46fcshj3w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a9cb505a-3c8c-4a9c-9fea-1cb20403fcdf
Unpacked files
SH256 hash:
ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157
MD5 hash:
bfdf14b4d5c067937e3a76161f99f206
SHA1 hash:
e435cbc2299fbeacfaa9bc8d1c678bd71b47c0ca
Link:
https://www.unpac.me/results/bcd41d5f-0efa-4820-9955-c9a3641b02bf/
SH256 hash:
8458d24886c59f7b412bccb1dbd5808005e3b6012182c99eda541a5f07c0477f
MD5 hash:
df69fdcb51f940ee76ffe7a810afacd2
SHA1 hash:
23483483be63d3801bc1b1c5741a57a4328c84c1
Link:
https://www.unpac.me/results/bcd41d5f-0efa-4820-9955-c9a3641b02bf/
SH256 hash:
8dda467b45f1593024560032ccfa8f7ae0a1021683b49920078e5a7258fd7e24
MD5 hash:
ef42c635435c5ecc2bc20fa2356f96cd
SHA1 hash:
3b50eb8fe7dd412fe829b66b2b53192078f05036
Link:
https://www.unpac.me/results/bcd41d5f-0efa-4820-9955-c9a3641b02bf/
SH256 hash:
11a82356d3b8f431315492b5e3345e761958d3dc1705ab0df0410d847197ac33
MD5 hash:
9f8548e867283a755ffdff29de66c041
SHA1 hash:
ea14c4edcf260ce16182e5a49cae4e223ac7d81a
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/bcd41d5f-0efa-4820-9955-c9a3641b02bf/
SH256 hash:
a7a95378c3498c75a00c9f00bcfadb3b25948a18635dcc14f72763f8e4b87c57
MD5 hash:
72bc08c8cc0e8705994618b74093d564
SHA1 hash:
d5221bcb6e0c718888fa9583abac6d121dbea8b5
Link:
https://www.unpac.me/results/bcd41d5f-0efa-4820-9955-c9a3641b02bf/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ae8ef5ed5365/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ae8ef5ed53654de05a32d157f76dfbdc2e734f842c3b815ec2ef5f37fd24f157

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/28321/

Comments