MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9
SHA3-384 hash: ca6bf3636b0d4b8e4fadd13d97e3fd67ba7edbbf7e13ae6d5d92a2d42e5c31cfd67085ba1c6a657b167c6119f8103181
SHA1 hash: ebb6e9a7b0f74520bcbf4e2ea5afc788aa57d8aa
MD5 hash: 82296a95f204903b8541c6d8352696e0
humanhash: kentucky-arizona-ceiling-william
File name:AL-25-913152.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'168'896 bytes
First seen:2025-11-19 14:02:14 UTC
Last seen:2025-12-08 15:14:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 91d07a5e22681e70764519ae943a5883 (120 x Formbook, 32 x a310Logger, 27 x AgentTesla)
ssdeep 24576:Atb20pkaCqT5TBWgNQ7a3C7kXpBTykzzp9aNZ6A:JVg5tQ7a3C7kDTNVo/5
TLSH T19C45CF1363DEC361C7B25273BA15B741AEBF782506B5F96B2FD8093DE820121521EA73
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d8568933b293cc3fc43317068681de2eaaf278ec808853b20f052a2cbe3da089.zip
Verdict:
Malicious activity
Analysis date:
2025-11-19 01:09:46 UTC
Tags:
arch-exec auto-startup
Link:
https://app.any.run/tasks/fc389dbd-9097-4a9a-8f0d-712da6149795

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38665/
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691d18d9bdb0ec3a9dc34d98
Tags:
nymeria autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Launching a process
Сreating synchronization primitives
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script fingerprint keylogger microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/691dcdecff47e7afc36d8cf6/reports/227a834c-48f1-430a-a407-f66b935fee26/overview
Verdict:
Malicious
Labled as:
AIT:Trojan.Nymeria
Link:
https://www.hybrid-analysis.com/sample/fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-18T21:15:00Z UTC
Last seen:
2025-11-21T08:56:00Z UTC
Hits:
~1000
Detections:
Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan.Win32.Strab.sb Trojan.Win32.Inject.sb Trojan.Win32.Auzenpak.sb Trojan-Spy.Noon.HTTP.ServerRequest Trojan-PSW.Win32.Stealer.sb PDM:Trojan.Win32.Generic Trojan.Win32.Zenpak.sb Trojan-Dropper.Win32.Dorifel.sbd Trojan.Win32.Strab.zna Trojan.Win32.Agent.sb
Link:
https://opentip.kaspersky.com/fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5473d3f7-f3e7-4d87-bac2-60d1fe5d854b
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/82296a95f204903b8541c6d8352696e0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-11-19 01:09:49 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ikbt4mitnfc6hlfzwqfsxho62tsbly63ponxtqj6zqliu7hwpmq._file
Verdict:
malicious
Label(s):
autoit
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/251119-rb9vzaaz7b/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Drops startup file
Executes dropped EXE
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ca086c2d-010e-4f12-a1e3-ffaa17c7f792
Unpacked files
SH256 hash:
fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9
MD5 hash:
82296a95f204903b8541c6d8352696e0
SHA1 hash:
ebb6e9a7b0f74520bcbf4e2ea5afc788aa57d8aa
Link:
https://www.unpac.me/results/19274836-7282-41e9-a8d6-f768a7c53a21/
SH256 hash:
61472fe59be217a4efc8044616fbced3ebb841ca67918d08aa4589dfc1e3c9f1
MD5 hash:
8ed05aa165a8042b16b71fcc768f7ee4
SHA1 hash:
79c80c7a895090cb20622346253476f371224db3
Link:
https://www.unpac.me/results/19274836-7282-41e9-a8d6-f768a7c53a21/
SH256 hash:
16c1afebc19776559fdb60fded6d96ba91199bf682100b412ed45c28ec229678
MD5 hash:
9a3aaf853d30b9b7a1b1d33c60cabbb2
SHA1 hash:
c9a3eebd82df09d8247b76b3bc8689b47fb6c183
Link:
https://www.unpac.me/results/19274836-7282-41e9-a8d6-f768a7c53a21/
SH256 hash:
d2c8d3fdb6425492b7820484894a9f0fdff4cb063e94da364780b8215f4d406a
MD5 hash:
155cedf23f25ac8d0ef389d6cf3ec1d9
SHA1 hash:
0a4c933740f12cf8a63201337e0843b03b33c4c2
Link:
https://www.unpac.me/results/19274836-7282-41e9-a8d6-f768a7c53a21/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fa1419f1889b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/38665/

Comments