MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85
SHA3-384 hash: 8e5ce599065d19b971b43472722f948d8c544366c8a70231ff54382d2e615b200f8e2f43e094876b0f877efae43fb42a
SHA1 hash: a29369439141b71869a3d04e46577df92bef1f8e
MD5 hash: dc2ba7f95ce2bb76195dec33f6a1af16
humanhash: tennessee-solar-uranus-nitrogen
File name:b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85
Download: download sample
Signature Formbook
Create hunting rule
File size:756'736 bytes
First seen:2025-11-06 10:23:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:C9MKq1uUUQeIL+AE7ng6/vgEqg/G5a5YFdd3bPXoVmSCur4gdhO7xKqX:Y6uUUQeW+A2GRHrPXlSCBGs1
Threatray 2'219 similar samples on MalwareBazaar
TLSH T1BFF41248671ADB02D92253F9A5B0F2782B3A5EFEA811D3168FD97CDB7936B044C44387
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85
Verdict:
No threats detected
Analysis date:
2025-11-06 11:43:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ed12e2dc-2157-42ae-87f5-bff4bb011093

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/35700/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c775dea0f3e915c237def
Tags:
agenttesla shell virus msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching the default Windows debugger (dwwin.exe)
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-13T12:50:00Z UTC
Last seen:
2025-11-08T08:30:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/308faa16-9409-4994-9943-305fec1837c3
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.41 Win 32 Exe x86
Link:
https://app.malva.re/file/dc2ba7f95ce2bb76195dec33f6a1af16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-11-06 10:24:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=woffavsu2uhgw7pn5r5acs5rgp5hm5squi7z6qfjmpknvg7nvkcq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
099aab7e93cc90414b63769dba429546e4f98953f1c8304f6b8109e6fa0a824e
Formbook
0c0d29b0bc5f1da6a937233d0105a891329e87a1b9b83b913bb3eb092d6d0ef1
Formbook
44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9
Formbook
71ebe950f825087c4c296fe5436be30c245c7c2a0605564b53274abe9bccbf55
Formbook
error
Formbook
f068fb3047695dbc66a4ca46c931ae9bc0834a4ac743044a5084fab7127d1342
Formbook
f5a2fcb5abc2713669bc271014e04c42c4e1019471616645ecacf791d53a3545
Formbook
+ 2'209 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/251106-mfkdnavnbj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/17a2822b-b836-43fe-8792-28f68bb197cb
Unpacked files
SH256 hash:
b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85
MD5 hash:
dc2ba7f95ce2bb76195dec33f6a1af16
SHA1 hash:
a29369439141b71869a3d04e46577df92bef1f8e
Link:
https://www.unpac.me/results/7dccc378-684f-4abc-8672-1907be1e9bb7/
SH256 hash:
99e74fa7b0c60480081a04abed57ea08046b814bd5d0d4a692f3ae02fba50168
MD5 hash:
19773658203fdd3729cd3f2e923bc0b9
SHA1 hash:
1edbc45de24dc8a7b34ed665438e454de81b9612
Link:
https://www.unpac.me/results/7dccc378-684f-4abc-8672-1907be1e9bb7/
SH256 hash:
7c17a9102dbf9358e86ae1f3aa908e5cad8ea237598b2ad7463bf7a4b9aa414b
MD5 hash:
12dfe7fb569aea59146a677229ca79c0
SHA1 hash:
3f14cfe6ff2803cb255fc449686cd59621f8b8d1
Link:
https://www.unpac.me/results/7dccc378-684f-4abc-8672-1907be1e9bb7/
SH256 hash:
9f330b84996d625d7dc134ef260f5e9167d0bd0a119c2a9803db142b9349f945
MD5 hash:
cc9c0281215bf173113432e332a78974
SHA1 hash:
6e82c52f8107b1ee3db493afff39abff2246d5a0
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7dccc378-684f-4abc-8672-1907be1e9bb7/
SH256 hash:
a1e6121dc5982fdf5dcf82378fd2502391053933963d8f4940a3b83267b635f4
MD5 hash:
1be8a69e7286fe316c4976a094f57268
SHA1 hash:
f324b54c634b06383a12d8b1296cd7e8955a0749
Link:
https://www.unpac.me/results/7dccc378-684f-4abc-8672-1907be1e9bb7/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b38a505654d5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b38a505654d50e6b7dedec7a014bb133fa767650a23f9f40a963d4da9bedaa85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/35700/

Comments