MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 20


Intelligence 20 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c
SHA3-384 hash: 61c9d32afd333207a9ffe65856e446a14bde999e11bc681ef5b1f255ae4d6d1c5d0f6c1a4e2cb570210f97b132ee6014
SHA1 hash: 667b8f387f690acfacb351c369561e814eb38a0e
MD5 hash: b8acbb63253a2d08dc3443da44622fce
humanhash: skylark-eight-echo-one
File name:f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c
Download: download sample
Signature Formbook
Create hunting rule
File size:934'912 bytes
First seen:2026-06-08 08:27:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'190 x AgentTesla, 20'337 x Formbook, 12'364 x SnakeKeylogger)
ssdeep 24576:OhwZtLtBA+aNyGU+N/pIuQqfarFYFGV2RJov/yojl:aw7tBAtDSrFYkv/yojl
Threatray 157 similar samples on MalwareBazaar
TLSH T11A150154221DDA1BE4A64FF40C32D2F417B45EE8A921D3038FEA7EEFB8763254955283
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5eb04749-f299-4e57-99e7-422db16dbddc/
Malware family:
n/a
ID:
1
File name:
_f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c.exe
Verdict:
Malicious activity
Analysis date:
2026-06-08 08:28:55 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/4d8bdb24-c040-41a0-88ac-103a12b5cdba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69505/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a267d333e9eff6a6b68b25f
Tags:
virus shell micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed vbnet
Link:
https://www.filescan.io/uploads/6a267d3fbf16337e43bb0a79/reports/6be63247-f37a-4b98-a6d1-3f63a24855ae/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-21T06:43:00Z UTC
Last seen:
2026-06-10T04:55:00Z UTC
Hits:
~1000
Detections:
HEUR:Trojan-PSW.MSIL.Agensla.gen Trojan.Win32.SpeedBit.sb Trojan-Dropper.Win32.Injector.sb PDM:Trojan.Win32.Generic Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Agent.sb Trojan-Spy.Noon.HTTP.ServerRequest Backdoor.Win32.Blakken.sb Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb
Link:
https://opentip.kaspersky.com/f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1211e563-4716-4ed6-b792-4f3c2a134a01
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c
Gathering data
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-05-21 09:53:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7eni5iimebagutkmuz2e3xhgt5g4spkjxtxc3nwy2ig6b54oozga._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
zgrat
Create hunting rule
Similar samples:
4e635e08da9caa7a6c08b4d401acbd9141bbde92d9f5cb5aafa03d6706cb228b
Formbook
4f6f49d76b427ecd1df55d94a028a143e1f3795c938c0612ec546775395fb130
Formbook
5ce77e84e2cd14e6127858e392fdc37d53bc87a5af9f9321cf7d336c18c10b03
Formbook
602caaecd7dca945a17cbe1522c89c7e6cb52330d2865f77637652009271553c
Formbook
65d0365b8d8a2b138824652c42e4042887969eb374322261f4d651caffd99c6e
Formbook
8dfa6515ab3df482f4c286932feec38420e606c8bb42e2055f4361db4fc638b9
Formbook
9e01b51f3fd3d019eb522b7794bb8407c43d85451fdaa4130579841600cc4c41
Formbook
aebe8d0e01c9c905de67582daeb2dd28854f33dd41825fd78824a30fc018d499
Formbook
dcba50a5be328e080a5496812c9c9d0d2f3bda66372fb376b716997e6323c16d
Formbook
error
Formbook
+ 147 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ge47 discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260608-kc87haay5z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c
MD5 hash:
b8acbb63253a2d08dc3443da44622fce
SHA1 hash:
667b8f387f690acfacb351c369561e814eb38a0e
Link:
https://www.unpac.me/results/29eddb59-818b-42f4-b9e8-0cf2150bec80/
SH256 hash:
a0dc8eb3e7064786bc838d663bc13381d79c21d94e4b21e962df58038b3da8d5
MD5 hash:
0c14a9b90c173b418f7854a4b6c0869d
SHA1 hash:
6e6771594a2797a9e1128dbf1dd91adbb111c049
Link:
https://www.unpac.me/results/29eddb59-818b-42f4-b9e8-0cf2150bec80/
SH256 hash:
30b8da6a6c14adb7188e67f556e4e4abdc4e0a47db4008b7a2930c21dbdf59c2
MD5 hash:
c25420b73d0fe1dd63cf91b94c810225
SHA1 hash:
8d54643580d5d5952e74ec53ebf93b91e398e9de
Link:
https://www.unpac.me/results/29eddb59-818b-42f4-b9e8-0cf2150bec80/
SH256 hash:
76852271077e1d05e81d722ae61aa5d241e0e085fd5cc76be0b88809efc83434
MD5 hash:
f96135401c5ad28c6ded37a9ce55919b
SHA1 hash:
7bc7fdce333f5851ec83390b5b73c6811983d36e
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
FormBook
Create hunting rule
Link:
https://www.unpac.me/results/29eddb59-818b-42f4-b9e8-0cf2150bec80/
Parent samples :
4e635e08da9caa7a6c08b4d401acbd9141bbde92d9f5cb5aafa03d6706cb228b
f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c
d140b5d801595363fb07538aa06d456e59572ce0c250ec6a0c8d2e3c2fabc56a
2028ed4a8655fc6d6607aa3c56851a877200e02d622d4ff634101ab71d969bcc
99841e88256948ff1d5f4c60599a3cc72284206864f1511d2ad5edac390e08f6
7642aed9ec9bbb6c3f1ae1847bcc5e919828a1edea702afc88dc00107c5333c0
47fee50ff965ff414236f87ead3d7093444f8fff31553ac09c978a7130701f85
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f91a8ea10c20/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f91a8ea10c20406a4d4ca6744ddce69f4dc93d49bcee2db6d8d20de0f78e764c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69505/

Comments