🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd2923950dfdeb9f34ee2da56bee4dc602431e3ce04e03476ea2c5aa54e13ae9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd2923950dfdeb9f34ee2da56bee4dc602431e3ce04e03476ea2c5aa54e13ae9
SHA3-384 hash: 7cd7047610443fd7f68dc42baafa71e00224cc257bf23a72528bd37fc3857b90ab4a7c6b801634affcdb14cc21a3655f
SHA1 hash: 38ab98356543f40712fe160c1d895c9b39fd9eef
MD5 hash: 1c9a2a9550f23cb248010b04207bca9c
humanhash: summer-helium-michigan-sierra
File name:cd2923950dfdeb9f34ee2da56bee4dc602431e3ce04e03476ea2c5aa54e13ae9
Download: download sample
Signature Formbook
Create hunting rule
File size:1'070'080 bytes
First seen:2026-09-04 20:17:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'218 x AgentTesla, 20'417 x Formbook, 12'370 x SnakeKeylogger)
ssdeep 12288:0ql2ZmSpGdCKwnzFy47hBj3GBYKttBrkhl9gBxpC6POp7OxS2gJr7slgzUU1Xn6U:ZSpUCFRy46YYSCWcgpA6UWn7n9vlww
TLSH T16835227C964AC802E88607710AF5E37632386EDCB512C2B3DBFDFDD77435A6A2859142
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon f8dce6533598dcf8 (1 x AsyncRAT, 1 x PureLogsStealer, 1 x Formbook)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3f7bdf58-82f2-4fc0-9cee-059d9447d6d5/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-04 20:27:50 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/8cadea89-c0ce-4b88-adab-e666f22d264b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83962/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Launching the default Windows debugger (dwwin.exe)
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm entropy formbook packed
Link:
https://www.filescan.io/uploads/6a9b27aa1f0e2532d054ee61/reports/1afbf25a-e84f-4b32-90ae-3b272af6c01c/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/cd2923950dfdeb9f34ee2da56bee4dc602431e3ce04e03476ea2c5aa54e13ae9
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-02T12:27:00Z UTC
Last seen:
2026-08-28T13:13:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/cd2923950dfdeb9f34ee2da56bee4dc602431e3ce04e03476ea2c5aa54e13ae9/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b3033993-8547-42ac-8509-4265ab2938d5
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cd2923950dfdeb9f34ee2da56bee4dc602431e3ce04e03476ea2c5aa54e13ae9
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.24 Win 32 Exe x86
Link:
https://app.malva.re/file/1c9a2a9550f23cb248010b04207bca9c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd2923950dfdeb9f34ee2da56bee4dc602431e3ce04e03476ea2c5aa54e13ae9/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 04:16:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
25 of 36 (69.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zuushfin7xvz6nhofwswx3snyybeghr44bhagr3oulc2uvhbhluq._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/789a3f92-32e9-40e0-8f5d-e00efb075496
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260904-y3k49ahm6x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
cd2923950dfdeb9f34ee2da56bee4dc602431e3ce04e03476ea2c5aa54e13ae9
MD5 hash:
1c9a2a9550f23cb248010b04207bca9c
SHA1 hash:
38ab98356543f40712fe160c1d895c9b39fd9eef
Link:
https://www.unpac.me/results/8d83e3c7-c471-4a2a-aeb2-8b74285aacd2/
SH256 hash:
7a227fa50dec6329a5abc556c5c9426ac61323ea8da064667b85af4ff1c977e1
MD5 hash:
97ee4363b31e2fecd18d7b108b7c9b93
SHA1 hash:
2f5b34180a08ad607931b6e853efe3314ed90ffe
Link:
https://www.unpac.me/results/8d83e3c7-c471-4a2a-aeb2-8b74285aacd2/
SH256 hash:
822908b58aac1f95d27c8f7061afa2b30dcb3f8e327eab6ed1a7990dd2df8227
MD5 hash:
cf35cdbe40e99800812768cd83842da5
SHA1 hash:
18129006c2c06e2d798a912c194ff77695b2fbb0
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/8d83e3c7-c471-4a2a-aeb2-8b74285aacd2/
SH256 hash:
2aaae48991785497a76e12a273d06e34f7e92331facc996db5f306100bafa15a
MD5 hash:
945e1caf51b7e869c02fbdc4acd021f0
SHA1 hash:
45e08897b6c5a975a4396f1fd8fbd0ce42c2b5fc
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/8d83e3c7-c471-4a2a-aeb2-8b74285aacd2/
SH256 hash:
d1b48252c49c9739a690f8ebb9767554a8dd19b15a05005e77e8ef4fe971cf9d
MD5 hash:
e5e1c0d0d8f90f380d75aaeedb3bd635
SHA1 hash:
be45f4538ad113685c946e2e0a2c8ef446ffa2b4
Link:
https://www.unpac.me/results/8d83e3c7-c471-4a2a-aeb2-8b74285aacd2/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cd2923950dfd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/83962/

Comments