MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 19


Intelligence 19 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e
SHA3-384 hash: ffcfada67c2f9894591a85329c2965756f4dbb08b246651b39f1d55df189fe51577b10a8d55a86f804b1cf641f5a9bbb
SHA1 hash: 09cd279a89aba0fcac6c116b62f22d0f46a128f3
MD5 hash: 1a85ec1e8ee0f908787db6629f172d14
humanhash: mars-wolfram-charlie-nitrogen
File name:e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e
Download: download sample
Signature Formbook
Create hunting rule
File size:665'600 bytes
First seen:2025-12-08 16:08:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:sw3UoDKOGevE+r1wT9qIXKC3RG4dd2RbU0s+GZS/phFcI9:HUoDK9aE+rOTsVmn2RU0s2Bj
Threatray 2'221 similar samples on MalwareBazaar
TLSH T1E4E422E06366ED32E4AA2FB71171E77127B23D9EE525D1078BDFACFB71091162008B25
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/15ba22e4-9ffd-4a58-8ca3-02c6450257ff/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
_e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e.exe
Verdict:
Malicious activity
Analysis date:
2025-12-08 16:50:11 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/c96ce5dd-6267-491e-9c58-6bb80a3841b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43853/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936f85adb58e1a2c22b9e46
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt packed snakekeylogger vbnet
Link:
https://www.filescan.io/uploads/6936f831bba50eaf042740fd/reports/bf9fc547-5bce-4a1b-8cfd-908eae0383d7/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-27T20:43:00Z UTC
Last seen:
2025-12-01T00:46:00Z UTC
Hits:
~100
Detections:
Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb HEUR:Trojan.MSIL.Taskun.gen Trojan-Spy.Noon.HTTP.ServerRequest PDM:Trojan.Win32.Generic Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Taskun.sb
Link:
https://opentip.kaspersky.com/e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.21 Win 32 Exe x86
Link:
https://app.malva.re/file/1a85ec1e8ee0f908787db6629f172d14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-11-27 22:40:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5aturbj5yczmtfr42nzfk4hkhwgygknwuen2fleriuagzlx256pa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
6ea09c48559f1730cd4e346d3b10791b9a5c9d4adb44079793fbe608b288af2b
Formbook
93d8f58337eb1309d7fadafe6707dde3a7d20d65870d05a689b3c2f264e61193
Formbook
d04519a5f28662179a347bfff8fb1a96984b9019d097cab9d6903069129370fb
Formbook
db603d2938218ca0b95c604a319858d625907401a9317fafce65d916c7858347
Formbook
ecd80dc690eee6d7f89ad7f036aed2000c548440fabd8df91ab539307eb317aa
Formbook
f700d8f24641f9310d77efafa721c329d43b1b568fa5c122cb624de9a8708968
Formbook
f7f0d0bcd56c2b929b687aa0c15305be4f71495d0b1ce5609fed155ddb0c016c
Formbook
+ 2'211 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/251208-tlzh4aep9t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2a2b7514-ad1b-487b-b391-0d9f6a76cf1b
Unpacked files
SH256 hash:
6aa7e535cd6f31c567adf4da966827d61038bf144d66ab8cabece6fe729968d4
MD5 hash:
512138e0c8f37f2b76725ff62f11f027
SHA1 hash:
1316dcf8967c096f7eebaf0c7d86b488ca3d7f5f
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/3ba691e6-a31a-4dc4-aa66-3740082030cb/
Parent samples :
f7f0d0bcd56c2b929b687aa0c15305be4f71495d0b1ce5609fed155ddb0c016c
a2e39401f7e09438f35e9a4ca0ce24dafbfef8c0b6250170f67fb9a4dfc0b63e
ae91525ecd727e79110dcc98c87e4e30402fbd47f95a2b153e7eda2da97a15fe
f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e
a3cc9d49257d9c9c8720c29baa025a2b5b35d1857497be67d5d2c09495a62562
SH256 hash:
2b25e3e0808ea9951f6214895960c04ccdc60f51db44dee1df030d83e65633f9
MD5 hash:
bd70e7a7489bb300083c684d7fcb0741
SHA1 hash:
184e3cd16d24348c720ce8fcc2f850ae68d255ab
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3ba691e6-a31a-4dc4-aa66-3740082030cb/
SH256 hash:
91030d5447116731194eee99959d17ab1d86145e15354caab28269f8f087fa33
MD5 hash:
6ff4737fc4d0ca185c961fec182bbaa5
SHA1 hash:
a3a6cdbd44f87c5124c6e1364a5b0a48268f6a1c
Link:
https://www.unpac.me/results/3ba691e6-a31a-4dc4-aa66-3740082030cb/
SH256 hash:
d6abacbe3e01ed785b6d9991b3cd1cf53b7cde335493b47dde7701882bbc3ca4
MD5 hash:
9e1946ce167d75b6d3b2de84ebd65dc5
SHA1 hash:
51c3067a5b7c94e24d75aeebf65fdce777fb45d1
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/3ba691e6-a31a-4dc4-aa66-3740082030cb/
SH256 hash:
e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e
MD5 hash:
1a85ec1e8ee0f908787db6629f172d14
SHA1 hash:
09cd279a89aba0fcac6c116b62f22d0f46a128f3
Link:
https://www.unpac.me/results/3ba691e6-a31a-4dc4-aa66-3740082030cb/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e82748853dc0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43853/

Comments