MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb
SHA3-384 hash: 1f81888ad69c1b49df6682316210c1fc8f9eb642d07b11cbf77f2e249561d4c220d6fc56c92b64052c06c36e9f1acd1f
SHA1 hash: a155852d3406137501a93fb9901ef2a42023f7ab
MD5 hash: 673bbc83845caafc2a881e76e96d8bcf
humanhash: snake-iowa-papa-romeo
File name:VESSEL Q88 PARTICULARS.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'585'664 bytes
First seen:2025-12-30 13:54:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bdbfb9e765f7e6795a47608e32c1d3d6 (1 x Formbook)
ssdeep 24576:0QfPhzrXNsZv9Vnscba1UIY2ahbkqLX5qVlMd0VttS51GB3G:0QXhzzSZv9NJmMd0Vta1A2
Threatray 110 similar samples on MalwareBazaar
TLSH T1E775BE14E29821ECE4ABD338CAA55632D6B178560B70A5CF06A8EF553F33AD05F7B305
TrID 56.8% (.EXE) InstallShield setup (43053/19/16)
13.8% (.EXE) Win64 Executable (generic) (10522/11/4)
8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Anonymous
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
PL PL
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
VESSEL Q88 PARTICULARS.zip
Verdict:
No threats detected
Analysis date:
2025-12-30 12:03:37 UTC
Tags:
arch-exec
Link:
https://app.any.run/tasks/1173626a-2ffb-415c-8d40-0da5016bb1dc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46579/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6953d9d07d915bf1778f0416
Tags:
injector virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6953d9cd2fb7bb52ca822966/reports/8824cdb5-49c5-493d-a101-2765d2c37987/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-30T03:45:00Z UTC
Last seen:
2025-12-31T11:57:00Z UTC
Hits:
~10000
Detections:
VHO:Trojan.Win32.Inject.gen VHO:Backdoor.MSIL.AsyncRat.gen Trojan.Win32.InjectorNetT.daz Trojan.Win32.Inject.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb/results?tab=lookup
Malware family:
QuirkyLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a879d3fd-ca23-4a67-aa13-ebdc26326da3
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/673bbc83845caafc2a881e76e96d8bcf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb/
Verdict:
Malicious
Threat:
VHO:Backdoor.MSIL.AsyncRat
Link:
https://tip.neiki.dev/file/278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-30 06:41:41 UTC
File Type:
PE+ (Exe)
Extracted files:
3
AV detection:
8 of 36 (22.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e6eqjmpgu3mery5rimmtmpmv6apetcwpcon4t6gvyndo2piozh5q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2d69b310e05770207e0dfbc31f64586a5edefe9fa24ec1c66bada9d50a2f5d05
Formbook
43b5215b6259c91a50783e08627245c8fa4d77c90030c3b043c26e4ce61fba32
Formbook
4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897
Formbook
867dc4d48c2fbef423c67cf481e33703e7e6a9494a400078298494777b23b18d
Formbook
9c25f0e398787875c5d4513495b884b4392df171d8ae8eecc8e32c762f81c63b
Formbook
ab8f034b89a3f3f3c7a77d3e5824fd4e4deb9734aa650cc78b0c3001e93a2a48
Formbook
adf865ce9f9f91f69f5b49b5002cdcf6b44ee24cccd911ef013c5470a58ee32c
Formbook
cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d
Formbook
cc7796413fb3fab847c0f15ef1359dd4d73ce859cb7a0f840243368aaa11eb30
Formbook
error
Formbook
fec34000664e9453638769da3413cddb271e791cbc5f8fb9c7697aeec8133f33
Formbook
+ 100 additional samples on MalwareBazaar
Gathering data
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/915c2668-e2db-4372-b317-46a8c4118613
Unpacked files
SH256 hash:
278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb
MD5 hash:
673bbc83845caafc2a881e76e96d8bcf
SHA1 hash:
a155852d3406137501a93fb9901ef2a42023f7ab
Link:
https://www.unpac.me/results/72080100-4a2b-45c3-acc9-f6dd79d4e96d/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/278904b1e6a6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/278904b1e6a6d848e3b14319363d95f01e498acf139bc9f8d5c346ed3d0ec9fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_Win_ETW_Bypass_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Windows ETW Bypass Detection Rule - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46579/

Comments