🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6
SHA3-384 hash: a599def9fc7dea78b632a3a14673921211d5975627fec1c74e3c75e9fa4b50b0883b3d333c4d4d6aad2c877107f58537
SHA1 hash: 4818c02fef49bc411e54a74247543d940de655a9
MD5 hash: 8a5bf0a3dfaa2def2eef649c06f50764
humanhash: vermont-ten-kitten-dakota
File name:b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:778'240 bytes
First seen:2026-10-13 05:41:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'614 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 12288:obT8E1uK4b7bANf5afgy6DKiisbQ+/eBIbkSiM3h0PkXPP2yDGW8cvNtqHu0t:obTHuJryogy6+KbQ+GBEzD/3rqO
TLSH T1CCF41219669CC127D96B0F7A19A2D230177B6DDEAA30C716AFE11DCF3A37B400624B53
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter whack_sh
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
212
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/41fccf6d-cfa7-4712-a63b-6756b6684f2e/
Malware family:
n/a
ID:
1
File name:
MT. Caribbean 1 Vessel Information.7z
Verdict:
Malicious activity
Analysis date:
2026-10-13 03:00:13 UTC
Tags:
arch-scr loader
Link:
https://app.any.run/tasks/1398262e-df83-4cd5-ac8b-099f3d1d4695

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/91625/
Detection(s):
SecuriteInfo.com.Trojan.Siggen35.63721.1403.1225.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
agenttesla dropper formbook packed vbnet
Link:
https://www.filescan.io/uploads/6acdc47b55d6609901bb0090/reports/55554793-5fd5-44bb-b934-b5078b42d8d9/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-12T23:39:00Z UTC
Last seen:
2026-10-14T18:37:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Spy.MSIL.Noon.gen Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan-Spy.Win32.Noon.sb Trojan-PSW.Win32.Stealer.sb
Link:
https://opentip.kaspersky.com/b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7e95ef1b-f632-4b2d-922b-660ac2173eeb
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1986290
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1986290 Sample: S0L5gIZd7p.exe Startdate: 13/10/2026 Architecture: WINDOWS Score: 100 32 xearazin.shop 2->32 34 www.shodaisupport.com 2->34 36 15 other IPs or domains 2->36 58 Suricata IDS alerts for network traffic 2->58 60 Antivirus detection for URL or domain 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 6 other signatures 2->64 8 S0L5gIZd7p.exe 4 2->8         started        12 eIxTnJzdpdRc4.exe 2->12 injected 14 EDAPOCaVBZAsMW.exe 2->14 injected signatures3 process4 dnsIp5 30 C:\Users\user\AppData\...\S0L5gIZd7p.exe.log, ASCII 8->30 dropped 66 Adds a directory exclusion to Windows Defender 8->66 68 Unusual module load detection (module proxying) 8->68 70 Switches to a custom stack to bypass stack traces 8->70 17 S0L5gIZd7p.exe 8->17         started        20 powershell.exe 23 8->20         started        22 SndVol.exe 13 12->22         started        38 www.shodaisupport.com 162.43.121.199, 49781, 49782, 49783 XSERVERXserverIncJP Japan 14->38 40 xearazin.shop 69.6.212.160, 49749, 49750, 49751 ORACLE-BMC-31898-OracleCorporationUS Brazil 14->40 42 11 other IPs or domains 14->42 file6 signatures7 process8 signatures9 44 Maps a DLL or memory area into another process 17->44 46 Queues an APC in another process (thread injection) 17->46 48 Found direct / indirect Syscall (likely to bypass EDR) 17->48 24 WmiPrvSE.exe 20->24         started        26 conhost.exe 20->26         started        50 Tries to steal Mail credentials (via file / registry access) 22->50 52 Tries to harvest and steal browser information (history, passwords, etc) 22->52 54 Modifies the context of a thread in another process (thread injection) 22->54 56 2 other signatures 22->56 28 firefox.exe 22->28         started        process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.38 Win 32 Exe x86
Link:
https://app.malva.re/file/8a5bf0a3dfaa2def2eef649c06f50764
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-10-13 05:37:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wkrsoja65d67l42fntjrzwtopnguhyw55febh4h2i7tj63jecs3a._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/261013-gdkczs11ds/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6
MD5 hash:
8a5bf0a3dfaa2def2eef649c06f50764
SHA1 hash:
4818c02fef49bc411e54a74247543d940de655a9
Link:
https://www.unpac.me/results/b8852c1c-0cad-4d0d-9004-7daeb1d133ad/
SH256 hash:
500a34a7da33cdba9f9211c5847ff59b9c5d336415a117db7ff54942cbe693a2
MD5 hash:
d07b585fef5f34b33614998c132ba88d
SHA1 hash:
801644e33da4fede7d267c6c4fed90d141c80ec7
Link:
https://www.unpac.me/results/b8852c1c-0cad-4d0d-9004-7daeb1d133ad/
SH256 hash:
61e1a6432185bf6ca35a2a6212c58ece3caa05e4eed67057fec5d445b5642b57
MD5 hash:
ef1f1dca29366be7f7709f3c905bef28
SHA1 hash:
e73bfe8eacebd0dbee6f7c303249faf5313eb60c
Link:
https://www.unpac.me/results/b8852c1c-0cad-4d0d-9004-7daeb1d133ad/
SH256 hash:
11c04cecd4a052cdd3d6e513bdef624368ca8958f23f2af9d4b735c3329221e3
MD5 hash:
89d913c3396d52642c863bd9ac1702ed
SHA1 hash:
7bf87725c554009200473e770d3ca3d007fdaea9
Link:
https://www.unpac.me/results/b8852c1c-0cad-4d0d-9004-7daeb1d133ad/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b2a327241ee8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe b2a327241ee8fdf5f3456cd31cda6e7b4d43e2dde94813f0fa47e69f6d2414b6

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3949347/
Cape
Cape
https://www.capesandbox.com/analysis/91625/

Comments