MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734
SHA3-384 hash: 1a2d00826eeb201968bd19341c90761e4f67f185920543c299de1baeff0505190470153d2083234a1ac3e7891d255cf7
SHA1 hash: 7f9650ca42eb46c148782e81c87328070a0a3927
MD5 hash: 531ec2dfb655411358385fbe41665f6a
humanhash: foxtrot-cardinal-victor-venus
File name:kindly quote your best price for the listed goods.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:784'896 bytes
First seen:2025-06-16 06:35:11 UTC
Last seen:2025-06-16 14:11:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:W1HJtLBpOOyetn7vGHdxY9uNGRMPwp769m5fT7uRacJJgiyMo+kRENsdARhV:W1HvHOfetDGHdmEGRCQeqfuRafMo+kKZ
TLSH T155F4024813E9D607F8EB17B81DB1E3745679AE9D7902C31B9EEDACEB32337005884256
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
482
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
kindly quote your best price for the listed goods.exe
Verdict:
No threats detected
Analysis date:
2025-06-16 06:37:10 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/a255f5d0-e2c7-4db0-9eb8-9b17fa5e6586

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9547/
Detection(s):
SecuriteInfo.com.BackDoor.AgentTeslaNET.37.1506.21365.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684fbd6707b5e8c1cfe6dd4e
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Labled as:
Trojan.GenericS
Link:
https://www.hybrid-analysis.com/sample/61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40fda1c5-39b0-4bcc-b018-c7bf3047299a
Result
Threat name:
FormBook, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1715143
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1715143 Sample: kindly quote your best pric... Startdate: 16/06/2025 Architecture: WINDOWS Score: 100 29 www.restrainreflection.xyz 2->29 31 www.melayari.xyz 2->31 33 20 other IPs or domains 2->33 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected PureLog Stealer 2->43 45 Yara detected FormBook 2->45 49 4 other signatures 2->49 10 kindly quote your best price for the listed goods.exe 3 2->10         started        signatures3 47 Performs DNS queries to domains with low reputation 31->47 process4 file5 27 kindly quote your ...isted goods.exe.log, ASCII 10->27 dropped 59 Injects a PE file into a foreign processes 10->59 14 kindly quote your best price for the listed goods.exe 10->14         started        signatures6 process7 signatures8 61 Maps a DLL or memory area into another process 14->61 17 IIyQG9EckgS.exe 14->17 injected process9 process10 19 ktmutil.exe 13 17->19         started        signatures11 51 Tries to steal Mail credentials (via file / registry access) 19->51 53 Tries to harvest and steal browser information (history, passwords, etc) 19->53 55 Modifies the context of a thread in another process (thread injection) 19->55 57 3 other signatures 19->57 22 MYmJTAwi3l1T.exe 19->22 injected 25 firefox.exe 19->25         started        process12 dnsIp13 35 www.aibay.top 185.27.134.103, 49709, 49710, 49711 WILDCARD-ASWildcardUKLimitedGB United Kingdom 22->35 37 reviewsonline.shop 84.32.84.32, 49701, 49702, 49703 NTT-LT-ASLT Lithuania 22->37 39 10 other IPs or domains 22->39
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-06-13 04:59:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhb4v3bkhskusrevksntwu4n3o6deqhlpfffpldvttsbms4ia42a._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250616-hd4masvly2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9da3fcb8-a32f-4bcb-9929-492eb670efce
Unpacked files
SH256 hash:
61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734
MD5 hash:
531ec2dfb655411358385fbe41665f6a
SHA1 hash:
7f9650ca42eb46c148782e81c87328070a0a3927
Link:
https://www.unpac.me/results/f65dd61a-8196-4ddb-bd05-2c3e12b0794d/
SH256 hash:
8f3da69570aaff58c78bb6ae7767ab96db446096d0916cbbecf19d6677f3e820
MD5 hash:
aee17dd0899b5e74e3356500535b3d26
SHA1 hash:
7763796bdab0c471860ccebe5313f7538230a51f
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f65dd61a-8196-4ddb-bd05-2c3e12b0794d/
SH256 hash:
96e9950cf67974cb77800bfde13101e99a4e42f3cb9d72c3bc23231d84556f43
MD5 hash:
c779c93bc76b82192b8b4e404bc057f3
SHA1 hash:
a66b3d25c0e0fa462bb97091591002a43c89b887
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f65dd61a-8196-4ddb-bd05-2c3e12b0794d/
Parent samples :
b5bdb3730680b32893f9c4d355682be1582689788762469bdb4efdda8376a57b
5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f
47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada
00181f3297555dab913f5777fc7823c4882929ee81cb52430d19714b8fa85734
ce161a633b539864473065ef127ba76ce9c2202aaee184dbbee5968563462a74
156ffbc1adf860198501bf76e6428debdfa847e13e73796ee9bad6e982bf94d4
b7ca5eee2c0af78525e33094a2c1d38f639824b8f051a50216dc47417f426bba
07b152394aab317e08fc56aa9fd33236cc8ea7a71d58ab9d7660ac70ccb495ec
ecca275df0af28dbbd0b0d74c0eaf5b29194cb5293f1ccdd2ba87f203481852a
5f811f675d487ef9d0cd10ba5f095edadcb38eeeedaa5ec897b3994b954d3212
b72fd1024afa07ad46cd25049ae1ef5e7311b1b2bae35f769263332cf2e7d17d
61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734
SH256 hash:
00383de0838a17a8d61ca4375fb8b275297337d6cce73afe108efa35018058fc
MD5 hash:
9850dea4433e133e33091b18c7a6bb32
SHA1 hash:
d739029a85827add4061388535457d264f22ac7c
Link:
https://www.unpac.me/results/f65dd61a-8196-4ddb-bd05-2c3e12b0794d/
SH256 hash:
dc03fe83b88ecd1086340cf60835c034e6a1dc13538bc872ee54e5b62ea996d8
MD5 hash:
8d9f571c83edc271de7077347418d417
SHA1 hash:
ecf49ede1240ed0582260fd0943a5b1fff0b470c
Link:
https://www.unpac.me/results/f65dd61a-8196-4ddb-bd05-2c3e12b0794d/
Malware family:
zgRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/61c3caec2a3c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Runtime_Broker_Variant_1
Create hunting rule
Author:Sn0wFr0$t
Description:Detecting malicious Runtime Broker
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/9547/

Comments