🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe
SHA3-384 hash: 627e9033641b13d12fe8b411063b8f1f54224e7491db09616909b019337cbb26a320b26ed5a53ae04b06551ac901b65e
SHA1 hash: e30318cb4c9fe932c0721c45eededf23005e0269
MD5 hash: 36ca72dd9c70f3d8ca05e1b4e30f1001
humanhash: mobile-fix-north-texas
File name:ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'552'384 bytes
First seen:2026-10-19 07:53:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'697 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 24576:lMAgecQfOeoHfXil9Xx+8ectKzllgPXHRvOErQt/rxrbebmZ4ga5BQe3XVC:ltvcQfif+9X1erUPXx2mQt/rxrbrqTQt
TLSH T1CF75E029012B4602D8B27FF41D71A1F4AB76ACA6B139C1255EDA0CEBF67B7007D4172B
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 30f0ccccccccd4c4 (4 x Formbook, 1 x AgentTesla, 1 x XWorm)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0ba13701-926d-438b-bfaa-1588f25b08b3/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-19 10:01:34 UTC
Tags:
formbook stealer xloader
Link:
https://app.any.run/tasks/8b24e65a-badc-4a56-a72a-07ed343d5e6e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/92746/
Detection(s):
SecuriteInfo.com.Trojan.BankBot.3638.83998521.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad5e0d6afb06e650cd7d6e8
Tags:
virus cupi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Searching for synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-04T01:18:00Z UTC
Last seen:
2026-10-17T01:28:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/389d52aa-e009-48ae-8fbe-6261aee405f8
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.30 Win 32 Exe x86
Link:
https://app.malva.re/file/36ca72dd9c70f3d8ca05e1b4e30f1001
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe/
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2026-09-05 04:28:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5r7l4hh3bmuwm22324srzjmrukgshitezzz67jgyy4hz7sirot7a._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/a3aa79e2-816d-480b-9b88-153cf8be0bff
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:goho discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/261019-jrq4sszy9l/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe
MD5 hash:
36ca72dd9c70f3d8ca05e1b4e30f1001
SHA1 hash:
e30318cb4c9fe932c0721c45eededf23005e0269
Link:
https://www.unpac.me/results/3efd3786-fa30-47b0-bc1f-30302a2917fb/
SH256 hash:
15a3a403cbacef1be7de2dfa7e009d9a2fde086949032ea91022e06bfab4e283
MD5 hash:
3c138cfd2460ac7ef7ea0cf80ee3fc00
SHA1 hash:
4dd7c06063a05a9ff3c1a1a5a89f5561ed0a8ce7
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3efd3786-fa30-47b0-bc1f-30302a2917fb/
SH256 hash:
c99215c6a6bce1bf58ef13f108a09e070b13eaa98ede76ba2f53b713d9c3cac8
MD5 hash:
46cbc445b546b2fa5991c0db6fba9bc2
SHA1 hash:
5269193200e808e0b536d12bc68d4078dd037b2e
Link:
https://www.unpac.me/results/3efd3786-fa30-47b0-bc1f-30302a2917fb/
SH256 hash:
618a08e5f1c4b8f0ca1b1780b9754263af178e099b6ae9196e5be27b74161327
MD5 hash:
31b24efbfa923762c06873b962b805f6
SHA1 hash:
87c462350de398333c476e6bdfc8038a6a8fa41c
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Formbook
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Link:
https://www.unpac.me/results/3efd3786-fa30-47b0-bc1f-30302a2917fb/
Parent samples :
b13566d9fe407cc22c901a4a624a326999c74ec3e63ee1b2772741e460333c77
c4e4375701cb85ee71bf3182cdabd6ab27ef71c9cc635469f76c85da29f4e102
c6e8b9f58ecf04c30658cddccbb2221d2eda992a51c9f252adc1e1a35b382260
ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe
0e3020607aec6a3d096692f24f1e390c44073f6b0e31c3260f21beced5e9bcce
4fb101b5f161c5153f59b835fae8a992f26474bec32fef3fe0c76e57240398c9
5a188883f428286c0a7fe084f861c9de5f52fe24763bb61e5c419f56b7628c88
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ec7ebe1cfb0b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ec7ebe1cfb0b29666b5bd7251ca591a28d23a264ce73efa4d8c70f9fc91174fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/92746/

Comments