MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae
SHA3-384 hash: 410bc4b075a714f32eed9ab8e341a0bc17a1b523c677974f196d78c56010ee6d69a14918ad1bb324bb727b9cad085428
SHA1 hash: dbb8bb6cd47267cf83ff3b594514451fef9f77ed
MD5 hash: 6dfbfaf345226ae453c7f3a2b39fb8e5
humanhash: east-alanine-fruit-indigo
File name:e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae
Download: download sample
Signature Formbook
Create hunting rule
File size:737'280 bytes
First seen:2025-07-07 14:17:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:wvQa9doBLbOI8ewPrT19zvgKp+1hGr7wYN2ONnOx/GgE0iVDOPX3TVYoSCmLBzni:Sr9CBLbzwHzvgKp+DGnN2ONOxQlFIbSk
Threatray 1 similar samples on MalwareBazaar
TLSH T11BF41245A786DA62D4F903B04931E3B71379AEDEA401C35BD8FEFCE7B8263593451282
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
19
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12818/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686bd70ac9eb974737676ae3
Tags:
virus msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c297cb94-178f-49dc-88ae-9fe089baeea6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.01 Win 32 Exe x86
Link:
https://app.malva.re/file/6dfbfaf345226ae453c7f3a2b39fb8e5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae/
Threat name:
ByteCode-MSIL.Trojan.VIPKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-06-18 10:12:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5c4htmy2aue3ir5qs5poevpqpoqurqfgvegnxiely4lsxaqngwxa._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
formbook
Create hunting rule
Similar samples:
df6da3ee9daf4cfd9047fa531202f860f6296e009f2f4eb0c1e2905cea319b09
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/250707-rlwq4asrt6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b7068a85-9705-4635-b8ba-58b1e02f834e
Unpacked files
SH256 hash:
e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae
MD5 hash:
6dfbfaf345226ae453c7f3a2b39fb8e5
SHA1 hash:
dbb8bb6cd47267cf83ff3b594514451fef9f77ed
Link:
https://www.unpac.me/results/329c7c6b-d5d8-4158-a783-a780eaf74612/
SH256 hash:
6247951f92a0c7e6ee21bae6f748be3ebea899b10ae6672eb5a971918a0b68b0
MD5 hash:
e8e4a329c82bfa27b4cfbaa23d564ed1
SHA1 hash:
009a7775bba4a18564de97e86df093fe9cd844c7
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/329c7c6b-d5d8-4158-a783-a780eaf74612/
Parent samples :
00f7ff43b4690c065497bdae404f265e1283d847b6e284408ae6ec73cc7dcd71
e66777ee4d792b1c933b9bff5d2777df26e5da6e3a5f2ae6e9e38e4e662644e5
9b4e541549ce7327a7fa91c7707365dec04a060b4b63b97798410658847f8c1c
e80896f3ce016957ff20d7b18f546daaead13afd31d7c8c8f94d4039b01db118
d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a
446ac5b2673ba02db508a71c3c821a4f5b2f6d9b0f8e4af62a7b747dceae33a9
f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d
e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae
SH256 hash:
8c924f81ef8e4da18a1287495ee82e7f185a4a0da1d2a7f16c4affe2090afd52
MD5 hash:
764dbf435c73dcf7e1e80d803490826f
SHA1 hash:
1fcec903d41bd97ae4f4a2f82d7607997c62a1d1
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/329c7c6b-d5d8-4158-a783-a780eaf74612/
SH256 hash:
c808cf16288aa3a3e76f83c125c5c2a588800572875aad6b5c7599c63a8862c5
MD5 hash:
6f695ea5c92faa87d23877266275276c
SHA1 hash:
97b99d50ae426fe856dd6eeca775194092bc616f
Link:
https://www.unpac.me/results/329c7c6b-d5d8-4158-a783-a780eaf74612/
SH256 hash:
891f8120df2c0cbc0f4fee13f871243416689bd2a8e7c8bb303291d13cad02a5
MD5 hash:
51ebe29b3ecde7d585c00380d5bf6e56
SHA1 hash:
275b526b40bfb6765903eb3ae9f115ef32150a7e
Link:
https://www.unpac.me/results/329c7c6b-d5d8-4158-a783-a780eaf74612/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Runtime_Broker_Variant_1
Create hunting rule
Author:Sn0wFr0$t
Description:Detecting malicious Runtime Broker
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12818/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (Unrestricted:true)high

Comments