MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638
SHA3-384 hash: aea53992fefa6914937b12b1bb4ffab50a0b5980b8f646eb2e26f2924fd6bde8aed9195853f4eedc46322cf86a3ffcde
SHA1 hash: 522cc17da398923d7e21f1d693ff5fc604751b18
MD5 hash: e76e75b7ebe150866d5b2b4046c3a3bc
humanhash: dakota-william-muppet-illinois
File name:d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638
Download: download sample
Signature Formbook
Create hunting rule
File size:758'272 bytes
First seen:2025-10-09 15:03:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:r0UCcFF4mHwZZes4kkEpyD9C+jYs6KLHSwBhHywNzv/5uSfRDkBvdAlrlpPsWhL1:PFXVvAyD9C+jYItDywFQSxkdmyWhzl
Threatray 1'950 similar samples on MalwareBazaar
TLSH T147F4025517BAFF03D0E61BF85AB0D3761779AE84A511E2478EF7ACEFB8257412804282
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638.exe
Verdict:
Malicious activity
Analysis date:
2025-10-09 19:27:20 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/af047203-6895-49fd-8b2c-dc127507247d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31817/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.4183.11136.28592.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e7d17223804d0975b631da
Tags:
virus spawn shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Launching a process
Creating a file
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/68e7ee44c74bd2958b174f1d/reports/d7d4faf3-df4d-4dac-999f-6925beb5fc24/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-26T04:55:00Z UTC
Last seen:
2025-10-09T10:18:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/519a482d-2c45-4fff-af25-29a0a51acda3
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.51 Win 32 Exe x86
Link:
https://app.malva.re/file/e76e75b7ebe150866d5b2b4046c3a3bc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638
Threat name:
ByteCode-MSIL.Trojan.PureLogStealer
Create hunting rule
Status:
Malicious
First seen:
2025-09-26 07:51:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=26tro6yatb45eujjgfaxspxrjomm5e2qze5nwkaizepbedvpgy4a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unc_loader_078
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
0002a2f7d00d1d6c5289a0c6915c6a761145586b191c03d6ae9320ac487c9ed3
Formbook
268b6fdc221050949a2b624983380cd3fb268fecef2f5bb3a15d91611f3d8092
Formbook
3189a2a8530b26f87a47c614fd895e197d7fd0fc0900ae8551b44114b277dec8
Formbook
3a2ba2930632a0a60f6c74b40be24d474cf84c174d921bd8bab8903d59f01835
Formbook
40ead66f8b514c57ecda339f991d248e99c6a164b64d5f1e05d69567bfef1a0a
Formbook
583cd2c26e0d7bc786d76dbf50dd0a76c8026aafd39b6f932ee7dd6c4faa4601
Formbook
69a9b6e531a91d616c9d7405206f87b73b851e894e452cde8f4a16ebddd98156
Formbook
9ffa9e2811b32d5392d585c41d73158bcdd53f090f4b56652230353cb48dcc88
Formbook
b27f17a52b7a491a0887307a8e4984f283b8076c1e49d535863068c51758c8bc
Formbook
error
Formbook
f94f36ad5e8746f9b9dd6a23e079d8d12f0e55d49a96c761cba4b9bbde734f04
Formbook
+ 1'940 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/251009-vpr4vswzdt/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/16b08e1e-1fa9-4c04-85c9-41fabe941b70
Unpacked files
SH256 hash:
d7a7177b009879d251293141793ef14b98ce9350c93adb2808c91e120eaf3638
MD5 hash:
e76e75b7ebe150866d5b2b4046c3a3bc
SHA1 hash:
522cc17da398923d7e21f1d693ff5fc604751b18
Link:
https://www.unpac.me/results/a7eb7b61-41e3-4ec2-9497-e57657eb3e72/
SH256 hash:
134e5f48177b1e6aaa456b9cbeccee018feee2222695b73d74fd8ca86b4bfb27
MD5 hash:
bce4f3dff74bd099b181e423d8ad76de
SHA1 hash:
1552e91a184c005c4e71f74d2c7bec6784196b97
Link:
https://www.unpac.me/results/a7eb7b61-41e3-4ec2-9497-e57657eb3e72/
SH256 hash:
796895f86291ed8b552b663173cd35dfdc48d2e7d038ce6ea103848955a16e37
MD5 hash:
55cbac1bb92f70f90ce3270f041a3903
SHA1 hash:
9f00900f531fbc8296420010126524b004e531ff
Link:
https://www.unpac.me/results/a7eb7b61-41e3-4ec2-9497-e57657eb3e72/
SH256 hash:
90f5a59a75217938e0389f0ec0868d0807be9355cb619a8f5937543d4bebf0c9
MD5 hash:
2a7038d4e5201855c23bf6676e5c484d
SHA1 hash:
b900227de9df87e7fe908df6e277d810d1f36cac
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/a7eb7b61-41e3-4ec2-9497-e57657eb3e72/
SH256 hash:
aea75213c84b76386d18bd834864f249f637770c0f6455953b98ffad1379518c
MD5 hash:
698e426feb2deab378df20d7dc677904
SHA1 hash:
9d46d80beebf74a501b125e5910e33d02bfad9a5
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/a7eb7b61-41e3-4ec2-9497-e57657eb3e72/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31817/

Comments