MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 27 File information Comments

SHA256 hash:	c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8
SHA3-384 hash:	972fe0aa25ce075d9123c315684516a94be8ad115e0746bcd9b7f423b103af8fb06f20b7f74f569b07108d7b2347a662
SHA1 hash:	fbf3254e79693f600e193bc5a06c3cbabe26495d
MD5 hash:	c27ba5f1da598bc9fee332c0edf1b070
humanhash:	echo-butter-ink-alanine
File name:	c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8
Download:	download sample
Signature	Formbook Create hunting rule
File size:	785'408 bytes
First seen:	2025-10-09 14:37:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:nB1GVmloRkqC34WliJUspTBnJwwayYi0v4VOEhqF50P3PR4xRsJQQrhlnIGWRiWb:BzB4eiBpTBJwwCi0v4sEhaCvyPBufnEe
Threatray	1'855 similar samples on MalwareBazaar
TLSH	T111F40205275EEA02D4A21BF44870E7790778AE9E7911C3478FEAACEF78353152D89387
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8

Verdict:

No threats detected

Analysis date:

2025-10-09 20:08:53 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/11417409-5c23-4727-a754-a2e9a8d63f80

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/31608/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e7ca817f305fa2545e027a

Tags:

shell virus micro

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a process with a hidden window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Adding an exclusion to Microsoft Defender

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/68e7d94a7c75fa33a278afcd/reports/403bfdb2-ac26-44c3-b703-c095a5a2e29f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-23T12:16:00Z UTC

Last seen:

2025-09-28T11:32:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/ff87d30c-feda-4bd6-a0d3-8c110bd5ae26

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.42 Win 32 Exe x86

Link:

https://app.malva.re/file/c27ba5f1da598bc9fee332c0edf1b070

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8/

Threat name:

ByteCode-MSIL.Trojan.RedLineStealer

Status:

Malicious

First seen:

2025-09-23 18:30:25 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zcqvapun7tskwkxqxwjh6ilm3jbgab6lmd33vjry6s7u5v2gk34a._file

Verdict:

malicious

Label(s):

unc_loader_078

unc_loader_037

Formbook

3167dcbb0fa3b1547f03510333141df87db2ad06324b388e0ce59b73d7e4c5f0

Formbook

5af12d4e35c3f1b595d9a0bac82476e2657547ebc7c622f721b81462fd4dac9d

Formbook

bb41674ddf9e288e3bf546dae1c5961bf515876dfbd4f78e16bbff0a590cacec

Formbook

cbcdb695b01086f65f353baf966651fc45d4d06a7cb5dfbf4472dfeb48ff2534

Formbook

d248a0c9b30b0ae7ba91096d8106ca1b97b706a4d10e3921caeab6e9031bd565

Formbook

e5c0d94c239bbf3aa57e92fd08403967b62ae2eaba19d1acc40400d4a1050cb0

Formbook

fd853f10022edbf3ee9b2601b31344f8ea537de6fa182b393bda9504a9e918d6

Formbook

+ 1'845 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/251009-s8w6ta1lz9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Formbook payload

Formbook

Formbook family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/63f50637-ad05-419d-aba7-28eb475bc163

Unpacked files

SH256 hash:

c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8

MD5 hash:

c27ba5f1da598bc9fee332c0edf1b070

SHA1 hash:

fbf3254e79693f600e193bc5a06c3cbabe26495d

Link:

https://www.unpac.me/results/4d73ae07-65f5-46a6-91e6-fda57b04ec60/

SH256 hash:

1041b538ccbc7d66e59247ef7551cde9b6c282843541585e9190a8e2e3943b12

MD5 hash:

e870d1e8f3791ccc141f85f40fd2972b

SHA1 hash:

150919ee289cffa6feb40ab8261f620dd7e26aac

Link:

https://www.unpac.me/results/4d73ae07-65f5-46a6-91e6-fda57b04ec60/

SH256 hash:

c08e40ca263b996b5929cfe1a9d8a38ce77770ce4f319b3fe4d3ffcf3d6c757d

MD5 hash:

b8f74cb7613f643fc61ce65b54cb5011

SHA1 hash:

201a9701fcddac451ad3a3f0ecf40bd85283b6b8

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/4d73ae07-65f5-46a6-91e6-fda57b04ec60/

SH256 hash:

7c32c98bef725bb66a30f348652841de8102af19c65d34a52e65771ae09e38d1

MD5 hash:

74a92f932bad193caa26b82f16dad7b7

SHA1 hash:

ab4d3edcc4887ad24eceede964e1066e1eb04e76

Link:

https://www.unpac.me/results/4d73ae07-65f5-46a6-91e6-fda57b04ec60/

SH256 hash:

6b74227e7599ba1678ecdfc59828defd288a57a64920808791dc528f2c4e6c1a

MD5 hash:

187ffe36547bdd8cfbc66dd716dcaa98

SHA1 hash:

5c1c567f2b53404dfaaeaf13174fb4c2725286c1

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/4d73ae07-65f5-46a6-91e6-fda57b04ec60/

Parent samples :

bb41674ddf9e288e3bf546dae1c5961bf515876dfbd4f78e16bbff0a590cacec
52aa545f64500659257ce324193e1e2ca1b06fe7e84873bcdca15db4e0aaba1a
66599dea9a4391eed990a634d789da4393ebe7bd33b8a11aef5aeb2bcd4e620e
c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8
bac9500e882b2ec0a430edd0a2fe89609f4ccb60befa4c46cb95281c480f3f11
b940e236d07bfe37f26f27a9cd08e5a3038e4b5529fbdfb385723873ba742ce6

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c8a1503e8dfc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c8a1503e8dfce4ab2af0bd927f216cda426007cb60f7baa638f4bf4ed74656f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/31608/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample