MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 16 File information Comments

SHA256 hash:	0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae
SHA3-384 hash:	192d0b257a7c536457d6af42cadc3022f2dffbee4f35a5c420aa2c86e4fd589028807458d0571762a949fcf44b5f4766
SHA1 hash:	eae0057fb80c15f930aa5491874aead2d6cda532
MD5 hash:	5748e921b3bf7c9cca2021982eb22671
humanhash:	undress-montana-alanine-golf
File name:	0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae
Download:	download sample
Signature	Formbook Create hunting rule
File size:	712'192 bytes
First seen:	2025-03-10 11:22:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ef471c0edf1877cd5a881a6a8bf647b9 (74 x Formbook, 33 x Loki, 29 x Loda)
ssdeep	12288:rOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi6hg/+FHrsSBO86PUsvqQbsFFw0+Rc:rq5TfcdHj4fmbO/+xrQFxvF4Fmjq
Threatray	2'053 similar samples on MalwareBazaar
TLSH	T113E423415598C877E5617732C07BCFE01AB6BD70CE882B6D0765F28D7D7229328CA61E
TrID	39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

339

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae

Verdict:

Suspicious activity

Analysis date:

2025-03-10 12:56:30 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/96ef9ade-ead8-47d4-80c8-92b43fd772dc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ced6850d1b39e3a208b0ad

Tags:

autorun autoit

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug autoit cmd compiled-script cscript hacktool lolbin microsoft_visual_cc mpcmdrun packed packed packed packer_detected rasautou upx wuauclt

Link:

https://www.filescan.io/uploads/67cecbb03c5f644bd94b172e/reports/7321d74e-36e4-4653-8a1a-a2a9d5ff8246/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6cdcace9-03f1-44bc-80a2-a25dd0893076

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1634862

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

Drops VBS files to the startup folder

Found direct / indirect Syscall (likely to bypass EDR)

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-02-21 06:20:30 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bqtiagx3dmalmsxfdzsgbvu4nu42kwv6ocdmyqfawq4qvq724wxa._file

Verdict:

malicious

Label(s):

autoit

unc_loader_036

Formbook

45088c3a74169ca81fe0ee21ff602bd352349d43436a70aaab88e93cc8f5fcda

Formbook

474651d4f8f510094648423d6a0d97b51d2847db856251740877331e101dd372

Formbook

c6755c9510ba4df19d3a59b8112844e667ac84aa30d629e414b5612df243ecfc

Formbook

e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777

Formbook

+ 2'043 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery upx

Link:

https://tria.ge/reports/250310-nhasnssn19/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Drops startup file

Executes dropped EXE

Loads dropped DLL

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e3d07970-88f0-43e1-a642-74a297c0a5ff

Unpacked files

SH256 hash:

0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae

MD5 hash:

5748e921b3bf7c9cca2021982eb22671

SHA1 hash:

eae0057fb80c15f930aa5491874aead2d6cda532

Link:

https://www.unpac.me/results/f2a1cd0d-a030-47df-9bfa-2047569b110a/

SH256 hash:

e5f806104b1066530cbb2d0bc56c52a36f7145232851bda99d47da98396db443

MD5 hash:

255f4f5813ba266ef0237704f90632ff

SHA1 hash:

8871d09854a026f4a001a3f365e46eac1c89c423

Link:

https://www.unpac.me/results/f2a1cd0d-a030-47df-9bfa-2047569b110a/

SH256 hash:

e42b90db6ef73814fcf4d281d5793fc23d2b6843ce9e103b6e4c8784e162d8ae

MD5 hash:

ab22a7923eeea5992965afebf5442070

SHA1 hash:

4248c25c8ddc40c883b7739fbf97491ddb86ed9a

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/f2a1cd0d-a030-47df-9bfa-2047569b110a/

Parent samples :

45088c3a74169ca81fe0ee21ff602bd352349d43436a70aaab88e93cc8f5fcda
3d1701e167eb96e3954192b0558be7a9bb6579216bdaa5f7d79c8680689e89a2
8737c3134c0845f4a6b271b7359868bfbe48af2729203c1b37c8469995f60e8b
0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae

SH256 hash:

31ae97cc2c139273ae1b9aff2d892420a935a9cd8c3bfc9f2df7f7e8484c9c8e

MD5 hash:

221721bcd81fab1c6706f1a88988ac3d

SHA1 hash:

86847e574800739a0b9be7a71f3c857b5f259f20

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/f2a1cd0d-a030-47df-9bfa-2047569b110a/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0c26801afb1b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0c26801afb1b00b64ae51e6460d69c6d39a55abe7086cc40a0b4390ac3fae5ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetUseConnectionW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample