MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11
SHA3-384 hash: da15d78cd7bba77e2edc4b7bcdd2316fa2ce38a2edee343fa3ee2bd83d7e4002a27b4cd60e169bf66863753ffa127e0c
SHA1 hash: e4a23638662ab245092944f3b76345b11beffdbe
MD5 hash: bb5d3144cb91960c8fc3f932c781d112
humanhash: golf-bravo-kentucky-asparagus
File name:slynewbin.ps1
Download: download sample
Signature Formbook
Create hunting rule
File size:2'193'532 bytes
First seen:2025-10-23 00:56:23 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 24576:iBaInCIPCsINKuDHssLjjoZJIlZnxsDDzZCkc7J3Dd4N5ZJ7B4VCFUP0c7Y2WAHp:7
Threatray 2'087 similar samples on MalwareBazaar
TLSH T1FCA5B0F876047DE6666F436BDA96ACDC13A617239ACBA4CD8064B7C305A3375FE02C05
Magika powershell
Reporter BlinkzSec
Tags:FormBook ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
CZ CZ
Vendor Threat Intelligence
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f97d5b3edd081eba40ee9d
Tags:
vmdetect virus spawn shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm aspnet_compiler base64 evasive exploit krypt lolbin obfuscated powershell reconnaissance
Link:
https://www.filescan.io/uploads/68f97d51fd2d7e012f4ca366/reports/4a680f14-8f1f-4400-865f-8115b5137a25/overview
Verdict:
Suspicious
Labled as:
PowerShell/Agent.DKT trojan
Link:
https://www.hybrid-analysis.com/sample/2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11
Verdict:
Malicious
File Type:
ps1
First seen:
2025-10-22T22:16:00Z UTC
Last seen:
2025-10-23T10:13:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.InjectorNetT.s Trojan.PowerShell.Agent.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
PowerShell
Link:
https://app.malva.re/file/bb5d3144cb91960c8fc3f932c781d112
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11
Threat name:
Script-BAT.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-10-23 00:43:48 UTC
File Type:
Text (PowerShell)
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fivulgfsuqslxinq63q7ha36cjuneebjdmrokl3h5zvwyyvjl4iq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2ee3c5c332ea6089c6ed8b45857181afb4e1e3b63b89ffd1bdc897ea48bccb3d
Formbook
44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9
Formbook
47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5
Formbook
5b50cbb52c090dd0bddb9d9cf1801147fef289051354e618344e27a1375c63f0
Formbook
888ac41d73c32f1ba71b9170bf2c9b1cbcef25ed014d2bc0d52eaead6dbbfa86
Formbook
8c0cd5bdae1355f8bc7f7af9102fb77eb8b52e432cdbe17c27456be4af1082ab
Formbook
a4e1ceb8458e0bca4119adb33ded5b1ef154f0ba69594b2079fbbcfb48cbe4ce
Formbook
cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10
Formbook
error
Formbook
ffc8f79b6654ee83f5afac0fa12a5eeb666dc73b11d05c7fba51e7acab5928de
Formbook
+ 2'077 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook adware discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/251023-bard8seq2z/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Badlisted process makes network request
Formbook payload
Formbook
Formbook family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

PowerShell (PS) ps1 2a2b4598b2a424bba1b0f6e1f3837e1268d210291b22e52f67ee6b6c62a95f11

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3684222/
  
Delivery method
Distributed via web download

Comments