MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 17

Intelligence 17 IOCs YARA 18 File information Comments

SHA256 hash:	b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c
SHA3-384 hash:	338d1d08d603127bde47e57ca16062d78c04dae888db034aecf06135992ccef5f6d2fe750c0d38a2237eb3b8dbd3e061
SHA1 hash:	099e096eaf762e403e975bdd127d7ffc1aabca22
MD5 hash:	0d249f805fac61a3f040ae36d4ddf666
humanhash:	robin-alabama-finch-xray
File name:	b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c
Download:	download sample
Signature	Formbook Create hunting rule
File size:	761'344 bytes
First seen:	2025-11-06 10:50:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	21371b611d91188d602926b15db6bd48 (70 x Formbook, 33 x AgentTesla, 20 x RemcosRAT)
ssdeep	12288:/z7hU5I5yuNHIgzSFKxWltRohBfSTso93U+gN+IFdv2IxJVCxgckoAr26+C/xlCm:/f+iN57Gtene3hgoIn2+JVCmoAd/x7rB
Threatray	2'085 similar samples on MalwareBazaar
TLSH	T1F0F4128EA644324BC940FC314832876E463A6E581AE95D0A5D3A7FAD0C777F36D7250F
TrID	39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	adrian__luca
Tags:	exe FormBook UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	761'344 bytes
File size (de-compressed) :	1'267'712 bytes
Format:	win32/pe
Unpacked file:	fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c

Verdict:

Malicious activity

Analysis date:

2025-11-06 15:53:23 UTC

Tags:

upx autoit

Link:

https://app.any.run/tasks/3b4cde9a-81fb-4583-81ad-8b482a3b9f8e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/35914/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690c7d8dea0f3e915c23855c

Tags:

virus spawn

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Labled as:

Doina.Generic

Link:

https://www.hybrid-analysis.com/sample/b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-16T21:16:00Z UTC

Last seen:

2025-11-08T04:37:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c/results?tab=lookup

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/358029c2-0a17-4927-899b-6587a8482ef2

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/0d249f805fac61a3f040ae36d4ddf666

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c/

Threat name:

Win32.Trojan.Autoitinject

Status:

Malicious

First seen:

2025-10-17 01:11:57 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wimdcsu52jeg3c625rslq6nyuf2maechazxn4easrtv6xz2m4iwa._file

Verdict:

malicious

Label(s):

formbook

Formbook

44d76c2813cbcbbc38602cf85005884c492f6eb76fbdac3e8279633d75fc5a0d

Formbook

480eba71b028d39614cfb7d3f83e75358348d256f8d27e687a4a85ba7499a1a4

Formbook

4c43b309ba3f6388617f713f68150812c71bf42bbb6de40399082fca221bc336

Formbook

75dfbb18396808592a7b46045f58a499b13169b13c75efa51f5c715d1d3f03e2

Formbook

911ab907376843edb05b47e615e37582276cc4af2b676727af7d61831d9fd044

Formbook

ccdf673390e032a11978be52ef503088dde4018bcf938522f848fee747715153

Formbook

f8b0f66cf4778ac6c5c91358e523994efec3065636e25d9487ec5d87dfbef14b

Formbook

+ 2'075 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan upx

Link:

https://tria.ge/reports/251106-mxhldsak3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Formbook payload

Formbook

Formbook family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/652cfee2-41b5-4ba5-b8c5-48658eaddc62

Unpacked files

SH256 hash:

b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c

MD5 hash:

0d249f805fac61a3f040ae36d4ddf666

SHA1 hash:

099e096eaf762e403e975bdd127d7ffc1aabca22

Link:

https://www.unpac.me/results/5a08edf7-4840-4205-9222-93abb8813d34/

SH256 hash:

fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950

MD5 hash:

564cde44342991c1d9ebbf46c434f599

SHA1 hash:

0d8b6cd199c68abc030018c9041bcc5abb37b989

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/5a08edf7-4840-4205-9222-93abb8813d34/

Parent samples :

b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c
fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950

SH256 hash:

7bc02e40d267f0806ccbe4ddf692cf7e30e15aea70d7459a62be513ef77c43fa

MD5 hash:

64bb70052b94833bae8c6c2ed8355480

SHA1 hash:

3c5b9df2ff518b5026fa23510781e3d1cd15cd5a

Link:

https://www.unpac.me/results/5a08edf7-4840-4205-9222-93abb8813d34/

SH256 hash:

10923ea59dd5331d65d4c3c6f3b2affe4fe0a0327df3c318ca00ac14e593f33c

MD5 hash:

b2f4c247b5952aba37ea591d73e90d62

SHA1 hash:

f56579ede6c544ebe589959fc0f9b2476990bb62

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/5a08edf7-4840-4205-9222-93abb8813d34/

Parent samples :

4c43b309ba3f6388617f713f68150812c71bf42bbb6de40399082fca221bc336
44d76c2813cbcbbc38602cf85005884c492f6eb76fbdac3e8279633d75fc5a0d
480eba71b028d39614cfb7d3f83e75358348d256f8d27e687a4a85ba7499a1a4
a63518cd5599294dd399f039241d3447a0c23ef0fcefd13fd3fda953fde6dfa6
b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c
fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950
51fcf05f52722a269f61e188e92353ce667a5d50cfae39f98e58c5dda12836bf
d03d5c962c99335e1ca1701937074be95c015d8f7cf37828c178b35acbd99309
ea03b1c2d2aa3ec74bf4194c7f623670e13df20b4bfdaae11f2e8604521f77e4
6e2c46144ecfe43364ca64844c46562391c994bac618e8c6e122922d14c64964
02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00
d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e
bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad
8c7cd6590e72250104c91c5dbff66bc376342ec4f0e870d913349db19ceacee4
a7b250c97316686083cfa7c3d5c9aa35aeaa2090e4b27a7a2a88ab8986dc6b54

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	TH_Win_ETW_Bypass_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Windows ETW Bypass Detection Rule - 2025
Reference:	https://cyfare.net/

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Formbook

exe b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c

(this sample)

Formbook

exe fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950

Cape

https://www.capesandbox.com/analysis/35914/

Dropping

SHA256 fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950

Dropping

MD5 564cde44342991c1d9ebbf46c434f599

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample