🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be
SHA3-384 hash: cf4514c03b855fbc1cd0af25978984847ef385b6f2c5ff117cadd6dff6fa86e830fb36ab2e4b6902569bb0f835a96c02
SHA1 hash: e06c957209a7f028696e7a422a2768553b147b09
MD5 hash: ee3d30ef93c2b841752005bce00d249d
humanhash: stream-floor-papa-sodium
File name:546__DC_00_generated_script.bat
Download: download sample
Signature Formbook
Create hunting rule
File size:10'338 bytes
First seen:2025-11-12 22:50:16 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 192:AcexhSCoDX9OggmCw74O1sV1vqh3ldKdm8jIVhMk3zCsBI6olqeGDYGQYd/Lz1Le:Acexh3A9OjmCw74C4vqh3ldKdm2IVaki
Threatray 2'272 similar samples on MalwareBazaar
TLSH T1A12233BCCAE5FCC08B1B72E079DAF6D710969703AD7B596CE99814650B00354EBB94CC
Magika batch
Reporter smica83
Tags:bat FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
546__DC_00_generated_script.bat
Verdict:
Malicious activity
Analysis date:
2025-11-12 22:53:25 UTC
Tags:
payload ta558 apt stegocampaign loader reverseloader susp-powershell
Link:
https://app.any.run/tasks/60e10d05-3e49-4165-8820-16cdbc39f0e7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/37770/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69150f3b60ebe843fe8d8377
Tags:
ransomware shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Sending a custom TCP request
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 obfuscated obfuscated powershell
Link:
https://www.filescan.io/uploads/69150f3752f9a0cdbd15ac66/reports/0ea3172d-4336-4ee5-acd1-17eda11a8ec2/overview
Verdict:
Malicious
Labled as:
PowerShell/Runner.U suspicious application
Link:
https://www.hybrid-analysis.com/sample/596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-12T10:24:00Z UTC
Last seen:
2025-11-14T00:52:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan.BAT.Alien.gen Backdoor.Agent.HTTP.C&C Trojan-Downloader.PowerShell.NanoShield.sb HEUR:Trojan.Multi.Stego.gen Trojan-Spy.Noon.HTTP.ServerRequest Trojan-Downloader.MSIL.Agent.c Trojan.MSIL.Crypt.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1813015
Signature
Antivirus detection for URL or domain
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Decrypt And Execute Base64 Data
Sigma detected: Suspicious PowerShell IEX Execution Patterns
Sigma detected: Suspicious Process Parents
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected FormBook
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1813015 Sample: 546__DC_00_generated_script.bat Startdate: 12/11/2025 Architecture: WINDOWS Score: 100 44 www.wontagents.xyz 2->44 46 www.wwwnetcomtech.ru 2->46 48 5 other IPs or domains 2->48 76 Suricata IDS alerts for network traffic 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 Antivirus detection for URL or domain 2->80 84 10 other signatures 2->84 13 cmd.exe 1 2->13         started        signatures3 82 Performs DNS queries to domains with low reputation 44->82 process4 signatures5 94 Suspicious powershell command line found 13->94 16 powershell.exe 12 13->16         started        19 conhost.exe 13->19         started        process6 signatures7 62 Suspicious powershell command line found 16->62 64 Suspicious execution chain found 16->64 66 Found suspicious powershell code related to unpacking or dynamic code loading 16->66 21 powershell.exe 14 17 16->21         started        process8 dnsIp9 56 wtfjwffxhjylazbkjfbf.supabase.co 104.18.38.10, 443, 49720 CLOUDFLARENETUS United States 21->56 58 raw.githubusercontent.com 185.199.108.133, 443, 49716 FASTLYUS Netherlands 21->58 60 nffjf.info 62.60.226.73, 443, 49719 ASLINE-AS-APASLINELIMITEDHK Iran (ISLAMIC Republic Of) 21->60 86 Writes to foreign memory regions 21->86 88 Injects a PE file into a foreign processes 21->88 25 RegAsm.exe 21->25         started        28 conhost.exe 21->28         started        signatures10 process11 signatures12 90 Maps a DLL or memory area into another process 25->90 92 Unusual module load detection (module proxying) 25->92 30 R7xyij98MY.exe 25->30 injected process13 process14 32 winver.exe 13 30->32         started        signatures15 68 Tries to steal Mail credentials (via file / registry access) 32->68 70 Tries to harvest and steal browser information (history, passwords, etc) 32->70 72 Modifies the context of a thread in another process (thread injection) 32->72 74 4 other signatures 32->74 35 dcNjVYsy0m0i.exe 32->35 injected 38 chrome.exe 32->38         started        40 firefox.exe 32->40         started        process16 dnsIp17 50 www.wwwnetcomtech.ru 194.85.61.76, 49726, 49727, 49728 RU-CENTERRU Russian Federation 35->50 52 www.sojee.cn 38.63.227.247, 49730, 49731, 49732 COGENT-174US United States 35->52 54 2 other IPs or domains 35->54 42 WerFault.exe 4 38->42         started        process18
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be/
Verdict:
Malicious
Threat:
Trojan.PowerShell.HTTP
Link:
https://tip.neiki.dev/file/596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-12 17:29:37 UTC
File Type:
Text (Batch)
AV detection:
5 of 38 (13.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lftft3rq6bxpgvk5ajnbqzn53eayxgr3cze3a35344a6pwxk7g7a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2fbff2faed784287ac85fac279c2c0348277552b46b0ffd1ca91d9a61ce8c91e
Formbook
364e7e17deb7c093a0c50be1bc63b42688f05a0be7816d47cbd648b8e984861a
Formbook
6b38991a8e0af1e548cb2f17b257032ce4150bdf2236f63cdaf34cc5e5d424ce
Formbook
8c8aab7fdb01ed318aafd40af4c010879fdacfda4c95089ccc1be38cfeebad92
Formbook
a4a5ded0761d6f514d131ff73aabce1cd8633f0c37fe83a5b4d6019413c28d5c
Formbook
bd289bf197d4a84046ab10da52a56de48eb317801d3931fb7b2fc36b279083d9
Formbook
d80e5353fa1942cb04ab1f9616e401835a42d292e4b4630a79340f1776eebe8b
Formbook
dd3876251da91bfe2d9af57cec442fc2c658a6841892f4ea8954c96260683393
Formbook
eb4f9a361af2fec77bcdea8b68e5aaf3d8e0ebbac245623975e99cf2a73861b3
Formbook
error
Formbook
+ 2'262 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/37770/

Comments