MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e6931f04ce362ba60baebc9659d1c807425bc45fe1dba012c8028058e740ded. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e6931f04ce362ba60baebc9659d1c807425bc45fe1dba012c8028058e740ded
SHA3-384 hash: 60604bbb0541bbe93a8828e8895bc3fd4a27dfea97553ce3d380cf00c774c0c550619a82bedab7ad482b5bf62826c3c5
SHA1 hash: 0d4a2a299f93a0dcf7da2222c8397dfe55e160be
MD5 hash: 0f274127a3cd7c3d23f346049a4a549a
humanhash: speaker-nineteen-virginia-nine
File name:YG.ps1
Download: download sample
Signature Formbook
Create hunting rule
File size:466'435 bytes
First seen:2025-03-21 19:49:52 UTC
Last seen:2025-03-22 10:43:57 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12288:CtJBLV7FqNcQpJ8pZNz5ng6DxDEJJ1Mwu6c489S:ClLBscQjgNz5g6dDsc6c489S
Threatray 22 similar samples on MalwareBazaar
TLSH T1EDA4DF318808BA2FCEEF0F97B5242FD27C78257BCE951454B48F15B85A78234297AF64
Magika powershell
Reporter skocherhan
Tags:176-65-144-3 FormBook opendir ps1


Avatar
skocherhan
http://176.65.144.3/FILE/YG.ps1

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
GB GB
Vendor Threat Intelligence
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ddc2ff115e7b48b48f8025
Tags:
packed spawn micro
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
confuserex dropper obfuscated obfuscated packed packed
Link:
https://www.filescan.io/uploads/67ddc2fea175d31773444830/reports/2d24689b-9ef0-4bd2-99c3-cab508c7e818/overview
Verdict:
Malicious
Labled as:
MSIL.Bladabindi.1;Gen:MSIL.Bladabindi.Generic
Link:
https://www.hybrid-analysis.com/sample/0e6931f04ce362ba60baebc9659d1c807425bc45fe1dba012c8028058e740ded
Result
Verdict:
MALICIOUS
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1645494
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Powershell drops PE file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Suspicious execution chain found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1645494 Sample: YG.ps1 Startdate: 21/03/2025 Architecture: WINDOWS Score: 100 46 www.uniservepro.xyz 2->46 48 www.jialei.xyz 2->48 50 10 other IPs or domains 2->50 64 Suricata IDS alerts for network traffic 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 Antivirus detection for URL or domain 2->68 72 5 other signatures 2->72 11 powershell.exe 16 2->11         started        15 svchost.exe 1 1 2->15         started        signatures3 70 Performs DNS queries to domains with low reputation 48->70 process4 dnsIp5 38 C:\Users\user\AppData\...\SDGHSDGHSD.exe, PE32 11->38 dropped 78 Suspicious execution chain found 11->78 80 Found suspicious powershell code related to unpacking or dynamic code loading 11->80 82 Powershell drops PE file 11->82 18 SDGHSDGHSD.exe 3 11->18         started        21 conhost.exe 11->21         started        52 127.0.0.1 unknown unknown 15->52 file6 signatures7 process8 signatures9 56 Antivirus detection for dropped file 18->56 58 Writes to foreign memory regions 18->58 60 Allocates memory in foreign processes 18->60 62 Injects a PE file into a foreign processes 18->62 23 RegAsm.exe 18->23         started        process10 signatures11 74 Maps a DLL or memory area into another process 23->74 26 hKUEKDnIeDLAJTTx8.exe 23->26 injected process12 signatures13 76 Found direct / indirect Syscall (likely to bypass EDR) 26->76 29 wiaacmgr.exe 13 26->29         started        process14 signatures15 84 Tries to steal Mail credentials (via file / registry access) 29->84 86 Tries to harvest and steal browser information (history, passwords, etc) 29->86 88 Modifies the context of a thread in another process (thread injection) 29->88 90 3 other signatures 29->90 32 hKUEKDnIeDLAJTTx8.exe 29->32 injected 36 firefox.exe 29->36         started        process16 dnsIp17 40 www.stpulse.live 209.74.79.41, 49965, 49966, 49967 MULTIBAND-NEWHOPEUS United States 32->40 42 www.peppypicks.org 52.223.13.41, 49973, 49974, 49975 AMAZONEXPANSIONGB United States 32->42 44 6 other IPs or domains 32->44 54 Found direct / indirect Syscall (likely to bypass EDR) 32->54 signatures18
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0e6931f04ce362ba60baebc9659d1c807425bc45fe1dba012c8028058e740ded
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e6931f04ce362ba60baebc9659d1c807425bc45fe1dba012c8028058e740ded/
Threat name:
ByteCode-MSIL.Backdoor.njRAT
Create hunting rule
Status:
Malicious
First seen:
2025-03-21 19:50:11 UTC
File Type:
Text
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bzutd4cm4nrluyf25pewlhi4qb2clpcf7yo3uajmqaualdtubxwq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0e6931f04ce362ba60baebc9659d1c807425bc45fe1dba012c8028058e740ded
Formbook
0ffb85454f582cc85ee5b77282c62c16c3f845706a850fb2b096ce287494073f
Formbook
41cbc855b5f9f98b5b15c3a88d712b64d6d99253950036e417448ea5955f2dc0
Formbook
ce0656d79699a86c7a59333646e0248408e03e9b8e157289fb8e04e520a251c3
Formbook
dac971c09595219e2190a7e73cd539496d26f4981c8a3e8a566aecd2dec7e7a4
Formbook
e9c775996d508887553a42f6d22b0b327e1b3a474d0dae1bcfd009b42d88c20b
Formbook
error
Formbook
+ 12 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250321-ykawka1nz7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e6931f04ce362ba60baebc9659d1c807425bc45fe1dba012c8028058e740ded

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:SUSP_PS1_FromBase64String_Content_Indicator_RID3714
Create hunting rule
Author:Florian Roth
Description:Detects suspicious base64 encoded PowerShell expressions
Reference:https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

PowerShell (PS) ps1 0e6931f04ce362ba60baebc9659d1c807425bc45fe1dba012c8028058e740ded

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3486312/
  
Delivery method
Distributed via web download

Comments