MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10
SHA3-384 hash: 623b1068fff6190bce0041419b2cae206493e2a223e0b1c2e9909d0f4261936574f519c9b624ab75de30498e84c8fa19
SHA1 hash: 5d2c70794598be26a77dcbdc009bd9730f4c67cf
MD5 hash: 7503c336e6854e0fd68af9dca257b930
humanhash: hamper-crazy-shade-victor
File name:QUOTE.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'072'640 bytes
First seen:2026-07-25 15:30:31 UTC
Last seen:2026-07-27 06:28:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'125 x AgentTesla, 20'148 x Formbook, 12'362 x SnakeKeylogger)
ssdeep 24576:29m2d07VES6WanbpA6d8agynZ7t8K7fhkSiKYzyp:liSQ6yZh/kSL
TLSH T15835023B8DC76F62C53C0F7881AA044C23F489579262E76F3FFD01A69FA17A48636591
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter JAMESWT_WT
Tags:exe FormBook Spam-ITA

Intelligence

File Origin
# of uploads :
2
# of downloads :
193
Origin country :
IT IT
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
Link:
https://research.acce.ciphertechsolutions.com/results/2899a4ed-bb52-454d-aabc-1586c6aadd88/
Malware family:
n/a
ID:
1
File name:
QUOTE.exe
Verdict:
No threats detected
Analysis date:
2026-07-25 15:32:06 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/13c7b6c6-6f00-4433-8982-3cc524792fd8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/76157/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.51187869.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6a64d6a178bbf033bc9249ef/reports/19129dde-c05b-4bf2-9653-895c0e22dba4/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-24T00:40:00Z UTC
Last seen:
2026-07-27T13:39:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/420f7bc9-160e-47ac-ace1-02430a033f5a
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/7503c336e6854e0fd68af9dca257b930
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-25 02:32:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2e4fcfphn3uzko4vtp5zmovo4gtxukdcqqvwtfo4av766mzlvqia._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/1b6b3c4f-2eec-4477-bfcf-640d6b2702b8
Similar samples:
198906594ae1cb1951d6e75e1921a7dd1188c8356371b847556ff15226dc5e83
Formbook
69698e5df2e1522285714141e20a245ec914a4ecdd71ce216e06210bec8107ce
Formbook
9714f79bb2296d3108cbf1c692bef6578e65bff5d17a80df942bbec516b45c84
Formbook
d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10
Formbook
eef5c5fa574616e79c45b3901e6d843172b8c7bebed1fd797c35f23155b7db9b
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260725-sxyv9s1dqh/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
.NET Reactor proctector
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10
MD5 hash:
7503c336e6854e0fd68af9dca257b930
SHA1 hash:
5d2c70794598be26a77dcbdc009bd9730f4c67cf
Link:
https://www.unpac.me/results/0a8d3e14-c822-4678-83fc-92ae9f9afb46/
SH256 hash:
e73743a45eb537cf9796496f0a31ffc882f7bbba65ae3cdf82cffd4c3cbeb977
MD5 hash:
1c66265ed46ff34ceae29f2a9ad73358
SHA1 hash:
8e2935c331474c410723b34eb0ce75d7eadb1e3a
Link:
https://www.unpac.me/results/0a8d3e14-c822-4678-83fc-92ae9f9afb46/
SH256 hash:
c452e33e70a96d20b8ec1e9f00048b7d294cee5ce2617e0f2fcf750795d4e54d
MD5 hash:
4930bc9a31f378e1d10352c0939a7ef8
SHA1 hash:
9000199dc601c374007c3486204ca46c39fcbeb9
Link:
https://www.unpac.me/results/0a8d3e14-c822-4678-83fc-92ae9f9afb46/
SH256 hash:
2c9a6d18cb8782c2887d81ee366bdaffd3907d39457a67945234e5e60f9345b1
MD5 hash:
daf39b51064c8f36ab287d89234d5316
SHA1 hash:
c444d046e4c88ab0cfe66cf69ab8a1d47a7eeb26
Link:
https://www.unpac.me/results/0a8d3e14-c822-4678-83fc-92ae9f9afb46/
SH256 hash:
796acfd240499a90c15a6b08743e334334c66575d99272f8ee90890abce844ae
MD5 hash:
44a2713e340b64cdee04451c7c9f0d61
SHA1 hash:
080cd9fa4e567bae63bb797ef96b1970d202eda6
Link:
https://www.unpac.me/results/0a8d3e14-c822-4678-83fc-92ae9f9afb46/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d1385115e76e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/76157/

Comments