MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 30 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822
SHA3-384 hash: 20c7688b901d4cd9aad2a7013f3f144da95b367615a2ee2e64cb9fd548c79afe5d6785360edecc21e48be7a2e6f79ae4
SHA1 hash: 0552acbc997077053728d7aab375de9970dfbdb0
MD5 hash: 966e491dd90a44fe982718eb674851cc
humanhash: minnesota-princess-speaker-one
File name:63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822
Download: download sample
Signature Formbook
Create hunting rule
File size:1'072'128 bytes
First seen:2025-06-10 09:27:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 12288:Ctb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgamT1WSA+lS6gDv++H+C5:Ctb20pkaCqT5TBWgNQ7a+9Dqv++eC6A
Threatray 4'244 similar samples on MalwareBazaar
TLSH T1C435CF1373DE8361C7B25273BA257701AEBF7C2506A1F96B2FD4093DE920162521EA73
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
294
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822
Verdict:
No threats detected
Analysis date:
2025-06-10 13:42:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6ba96fcd-b1e2-4730-8e7a-75afe9f7310b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/8525/
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6847fabd07b5e8c1cfe60d8a
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script findstr fingerprint hacktool keylogger lolbin microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/6847fabc69bfbf6bbcb9a096/reports/0a83a066-d41d-4695-bf89-38d1e6252414/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/12391442-9cf4-4d42-af4f-90f1dfe98f81
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1711455
Signature
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1711455 Sample: Kj8nY6f3iA.exe Startdate: 10/06/2025 Architecture: WINDOWS Score: 100 29 www.lokiboop.xyz 2->29 31 www.bbgpower.xyz 2->31 33 6 other IPs or domains 2->33 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Multi AV Scanner detection for submitted file 2->39 43 5 other signatures 2->43 11 Kj8nY6f3iA.exe 4 2->11         started        signatures3 41 Performs DNS queries to domains with low reputation 31->41 process4 signatures5 49 Binary is likely a compiled AutoIt script file 11->49 51 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 11->51 53 Writes to foreign memory regions 11->53 55 2 other signatures 11->55 14 svchost.exe 11->14         started        process6 signatures7 57 Modifies the context of a thread in another process (thread injection) 14->57 59 Maps a DLL or memory area into another process 14->59 61 Sample uses process hollowing technique 14->61 63 3 other signatures 14->63 17 explorer.exe 37 1 14->17 injected process8 dnsIp9 27 204.79.197.203, 443 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 17->27 20 msdt.exe 17->20         started        process10 signatures11 45 Modifies the context of a thread in another process (thread injection) 20->45 47 Maps a DLL or memory area into another process 20->47 23 cmd.exe 1 20->23         started        process12 process13 25 conhost.exe 23->25         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-05-25 23:38:59 UTC
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mo5cemoppar5lmzzf2nf5sjxfwqinztijvxrwqgwepyznstwvara._file
Verdict:
malicious
Label(s):
autoit
Create hunting rule
unc_loader_036
Create hunting rule
formbook
Create hunting rule
Similar samples:
19fbe34cba208ba97e666fe917df64eeb922747ce9b8cbaed65bd0197be59aaf
Formbook
28dbe468fda05030a239bd0f554cb207c31edd37b12b930a357dd43e265e67ad
Formbook
2e3fefb790f0aba5b0e8162081c037ed5035c2722fd318d928d94cfee57d110c
Formbook
68f825f78bc851d6f7f216c2d056b9e0e80702ffbfd02da528fd0b948357ba2f
Formbook
8a91c4bf99a674909e6993d52e061547517056d36f9b8e828a9148eb412ffa73
Formbook
dcb0dbfb5714fc8d31fb3ac35f060092959f1450655eac659d6f4ff36c3c790d
Formbook
ea5ad478df7db224610821def4d39b12ba7ef2f7a95fe88c9bc30a135bca5739
Formbook
+ 4'234 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:dy23 discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/250610-lfjaxsen6v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/47e412bc-18e2-403b-bf84-d6d90d2c3c25
Unpacked files
SH256 hash:
63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822
MD5 hash:
966e491dd90a44fe982718eb674851cc
SHA1 hash:
0552acbc997077053728d7aab375de9970dfbdb0
Link:
https://www.unpac.me/results/b25c58ef-bfb0-4c5f-b509-28b1ea40ab4e/
SH256 hash:
d5f45e8d1ebc6e27963fa4cc1bb9ac420801389de2f068a6d470b7c3d20ab51b
MD5 hash:
391726776e5e542e7173a5e15f154a79
SHA1 hash:
5fe9bc77752d45b556fc1b005c528860b5bc2a25
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
FormBook
Create hunting rule
Formbook
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Link:
https://www.unpac.me/results/b25c58ef-bfb0-4c5f-b509-28b1ea40ab4e/
Parent samples :
a32a1590d555e671aed186dd54bf92bd97a2ba545015ff229fa5fd4f2083bafa
3e59b168cc857271f9e414cbe209067683b91c36b655391122330b9709b5db76
f4057ca697143255e204a86561e5916d4bdc549f01b40e434a8c93cb164f0189
63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822
21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86
a6d3a6dcef28f70dc93b5d2350dd6825b6b66eb037d67dff0087f492d7a41b16
5861bf7bee0514a185417596051a31fddd7cc92d013500102f8d0ec849ff0e6f
9e75636398eb4c5ac5c079d2cebe56c8441815b5343c6199fc5de4254c91d844
a15dfab6c02371c2dbda3470c35b959beddfb4299d89bafced12fe684fd008d7
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/63ba2231cf7823d5b3392e9a5ec9372da086e6684d6f1b40d623f196ca76a822

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/8525/

Comments