MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 df7ae8cbf85a38ceab3551bf0f806fb3b6b62a2664d029c465309ffccf9f6d69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 18
| SHA256 hash: | df7ae8cbf85a38ceab3551bf0f806fb3b6b62a2664d029c465309ffccf9f6d69 |
|---|---|
| SHA3-384 hash: | 539cedf83463a9f774b899457479871e43f4a7f2f41a3899ad3070d1e04efc1dd74f556541a38843d7b5b7d10e518420 |
| SHA1 hash: | 9e63dfbb30f587f7e5f3bb6a859c0c7c36b1843f |
| MD5 hash: | dbdaf36a1022ca09a7ef6102b281a311 |
| humanhash: | spring-cat-golf-illinois |
| File name: | Quote-RFQ766567.scr |
| Download: | download sample |
| Signature | Formbook |
| File size: | 750'080 bytes |
| First seen: | 2025-12-08 14:01:45 UTC |
| Last seen: | 2026-01-09 15:23:48 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger) |
| ssdeep | 12288:fjFKfeh2hb94dzCFDJbiI2g2lqCmjLrER3Nvv1QLGcYGE32qhOAJwlOeyflKv/lE:pIBmGFDJWpbmreC5qhTwYey43ll |
| Threatray | 2'215 similar samples on MalwareBazaar |
| TLSH | T127F412B42998C412C9A11B711C26E3B2637A5D6EF813D32BCBCFCEFB35227906544663 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
87
Origin country :
HUVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
Quote-RFQ766567.scr
Verdict:
No threats detected
Analysis date:
2025-12-08 14:05:28 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
92.5%
Tags:
virus spawn msil
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
krypt masquerade packed vbnet
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-04T03:32:00Z UTC
Last seen:
2025-12-10T08:34:00Z UTC
Hits:
~1000
Detections:
VHO:Backdoor.Win32.Convagent.gen PDM:Trojan.Win32.Generic Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb Trojan-Spy.Noon.HTTP.ServerRequest Backdoor.Agent.HTTP.C&C Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Taskun.sb HEUR:Backdoor.MSIL.XWorm.gen
Malware family:
Formbook
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.52 Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.FORMBOOK
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2025-12-04 06:38:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 24 (83.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'205 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
df7ae8cbf85a38ceab3551bf0f806fb3b6b62a2664d029c465309ffccf9f6d69
MD5 hash:
dbdaf36a1022ca09a7ef6102b281a311
SHA1 hash:
9e63dfbb30f587f7e5f3bb6a859c0c7c36b1843f
SH256 hash:
5b71c27f1cf7fcf0070fddefb9e0b171d0bdff5eec6cee1b203d97eec8150f18
MD5 hash:
6d32ef85fae0ef3e7723f089c98d976d
SHA1 hash:
0648fc391cb004c4dbe931c2553463ecab964c2a
SH256 hash:
14d3b29a002901bc3db5d913d9f931f4a0e937942e909c492744db83de09e378
MD5 hash:
fa183d2a5050f010e198fe3bbdf5bc65
SHA1 hash:
aa03260b5b5695c3cc437db9ca12bf860654073e
SH256 hash:
023137c1dc67b5cceb1305b0b7d0baa4d4f789d3427f3405b6b14404a3b5d0e3
MD5 hash:
a7be2ecc937050238660de422bf3a079
SHA1 hash:
ad10d85efcb847d6b7fb2049bc02c13b356f0df7
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
080c0bc5204446a0f65ab24af16b4c79be3982bc9f705ed2c448a0efda0cda2e
MD5 hash:
bda5f09d82f38b2e445fc140a52f1fba
SHA1 hash:
c2487aeb6c805c1101965f3699730674539f7bec
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.