🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
SHA3-384 hash: a030fb065cd56d147289663cb7103c8e35468576f761297e0b79a33a4b9afb082553c4412c1614e8f6f267e5ae3eb899
SHA1 hash: b905664413ba0572a50e8bd813134c225c9a7c69
MD5 hash: 307b465ee59aa95d8c68223febc79a08
humanhash: nineteen-lion-virginia-hydrogen
File name:f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
Download: download sample
Signature Formbook
Create hunting rule
File size:892'928 bytes
First seen:2026-09-10 10:40:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'249 x AgentTesla, 20'539 x Formbook, 12'385 x SnakeKeylogger)
ssdeep 24576:pyVaKVpTrC4mhhU039urKsEXrKb0iiPYmdUnOhcrbZc:dKVZW4gXurKsEKtiPDiOir1c
TLSH T142152379A788D503E6DA0B3EAEB0D3B106B43D94E912D95BAFFD6CCB38767061604350
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 0000000000000000 (907 x AgentTesla, 573 x Formbook, 316 x RedLineStealer)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4d220c94-8635-4b5d-a949-16f436e7fc9f/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-10 11:50:23 UTC
Tags:
formbook stealer xloader
Link:
https://app.any.run/tasks/bd860c96-823b-4356-913b-7d80020b7265

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/84790/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac94f557dee0dd63c37fd7b
Tags:
shell virus micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-17T02:19:00Z UTC
Last seen:
2026-09-11T18:29:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/eb348058-882b-414a-80b4-4cc06bc734b6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.24 Win 32 Exe x86
Link:
https://app.malva.re/file/307b465ee59aa95d8c68223febc79a08
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2026-08-19 02:30:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qrt4nsmnwe6xhbufv7bmr64bsd75otgw4ap2h77bwe32w2khgha._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/ff5d8311-10e2-4f7f-a1c2-433f5b1646db
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ge11 discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260910-mra95abj6x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
MD5 hash:
307b465ee59aa95d8c68223febc79a08
SHA1 hash:
b905664413ba0572a50e8bd813134c225c9a7c69
Link:
https://www.unpac.me/results/5070875d-e7ee-42b6-b9b5-bc7301f6203b/
SH256 hash:
18faa871fb087619315efc24631ccb8f3528b10611ae2632f8180708bf4654a8
MD5 hash:
8b8ad2392c2cd03ef5537ad65d2646d7
SHA1 hash:
015ccd559020d5b61da1b26fd09d64d69b5fae18
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/5070875d-e7ee-42b6-b9b5-bc7301f6203b/
Parent samples :
34bae751324dcb623efb9c061f097d715b1d2d93587e9b0ea59017a9e5778f6e
6e482ca3bf3fcc53e4e91c43c50b1720a48090f3149fe7ff760c447a37c1ef04
cb0346cf3bf9665ec445b882981d5a1d05132601c7682051b234c2a391440750
a2ae20a3dae96a9c013499dda282f8b11a1c1a9758a001c3bedbb0b2184c6650
e5cfe69cb96d8fa21b39cb4a0dc60333fa7bacc7b452ebcd8acfbf58ef0625cf
2baf8b47911e361e0adc4834de3289f162ef118ac8c4cbcab98cb662746c6be3
7cf378dd9652caf18090ef97a17f93d4ec5bfd288b4493cc94d1039f1552f848
5d82d0ccc781b34d9a93164e0a7e723293755c21d6dd0fd23479f5f951d7014b
014d90b220ae7333d1811174a381cf9bce2befbc96f3ce66a3266b28aebcc652
4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902
4e13359697d315c3010c7d0747349146c428913d1b5bad117630102d1cbd5e2a
003e626ae5b7daa892d5d169f4be988ed47a6338c4f4610e7bf6e803a3972291
f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
4a66534fbea74b27fd7fa3262ac4d025d0f9108b20426b5cd7f8a1784affe2fd
5690a8784a72840def954a1bfa1ecc493e47d7ff013801feba99a1f75c17f30c
SH256 hash:
70d3a4f92d50b06a15f4ecd0f9b5aec9c6bb65303489913177907386ca91dae3
MD5 hash:
f1c2c47295c824996ddd998ee61cbf06
SHA1 hash:
cf7515b1c3e1957bb737f4f6aed1fae939830bfc
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/5070875d-e7ee-42b6-b9b5-bc7301f6203b/
SH256 hash:
18fb94f4d9e70e553dfda121cc1b0ad2adc832924f0295e1fac4ae4660e12615
MD5 hash:
07038afc6fbd0c3195f2e84990df0c80
SHA1 hash:
35654a22428a1931884f38bea25fc76267ea27bf
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Formbook
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Link:
https://www.unpac.me/results/5070875d-e7ee-42b6-b9b5-bc7301f6203b/
Parent samples :
c2950027214694211b93f45aff96f7eeb0b46c5ce15235a9775b50597c565416
3e11f7bd7b21eaa465fab6079458db678dfbe7099e9f2023c1f7f0c912e53d94
e99623a648141a2f03a7abcf5efa628bdf7fbe3760b1187048681f529cb8feaa
a0f98f3cc53d1a6a7ad0d9c2df1de1ea370d97dd8af04230d9bb7fb2f76d705a
cc9b6a5d4967278cca9da79ac7a99501d847d1da60d055409abffeadfb4ef761
94a33fc48ecb504091be4ab6c64cb3b828ac0efe1c9449c8ee952774de38b44f
f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
faf4efd14cfe28db1bc8fe68f9b8920207663ae936409aa2576eda80c1cb87cc
55f9b6eb0ffdc5343bead53ac947df1da92d1757370367c2b8bcbdf5e6906926
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f4233e364c6d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/84790/

Comments