MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65bcbf5fd47e0d3de349ea522b93b5564a143ce2a9f61693b6870ef14740bd63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 14

Intelligence 14 IOCs YARA 4 File information Comments

SHA256 hash:	65bcbf5fd47e0d3de349ea522b93b5564a143ce2a9f61693b6870ef14740bd63
SHA3-384 hash:	8e7a06932e75d543f9f535381dae7a4315be04dff47d605e6020f1eb8edc4829209bfe33d7b0238abc1b83ea60f01512
SHA1 hash:	8865f02fbcd9d23a406abe62cda9d288079ee041
MD5 hash:	b5c4935d686263a84a3bcdc69d5f725a
humanhash:	oklahoma-floor-harry-blossom
File name:	SecuriteInfo.com.MalwareX-gen.26165.22860
Download:	download sample
Signature	Formbook Create hunting rule
File size:	959'488 bytes
First seen:	2025-06-11 04:27:27 UTC
Last seen:	2025-06-11 17:44:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	24576:rsMG6MdAEelcVgnmHfuH4tLU+CKLnGVxAM:PEelKgnifc49PVu
Threatray	1'972 similar samples on MalwareBazaar
TLSH	T1E71512555662E613DAA207B0AEB2D37423796E9CA400E3138DEDFDF7B9367012C842D7
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	a2f09c8c96d2e0b2 (5 x Formbook, 2 x AgentTesla, 1 x MassLogger)
Reporter	SecuriteInfoCom
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

441

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.MalwareX-gen.26165.22860

Verdict:

No threats detected

Analysis date:

2025-06-11 04:50:00 UTC

Tags:

netreactor

Link:

https://app.any.run/tasks/7a2434c4-2f71-4ade-906b-d7ff2dc5edd5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/8879/

Detection(s):

SecuriteInfo.com.MalwareX-gen.26165.22860.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684908038bd5d68a12e7a0db

Tags:

virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/65bcbf5fd47e0d3de349ea522b93b5564a143ce2a9f61693b6870ef14740bd63

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/80912997-4190-40d2-bd32-58a2fcf22b7b

Result

Threat name:

FormBook, PureLog Stealer

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1711875

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Uses threadpools to delay analysis

Yara detected AntiVM3

Yara detected FormBook

Yara detected PureLog Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/65bcbf5fd47e0d3de349ea522b93b5564a143ce2a9f61693b6870ef14740bd63

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/65bcbf5fd47e0d3de349ea522b93b5564a143ce2a9f61693b6870ef14740bd63/

Threat name:

ByteCode-MSIL.Trojan.MassLogger

Status:

Malicious

First seen:

2025-06-11 04:29:20 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mw6l6x6upygt3y2j5jjcxe5vkzfbiphcvh3bne5wq4hpcr2axvrq._file

Verdict:

malicious

Label(s):

unc_loader_037

Formbook

c8b145a61b10d48f01b8ec21a0a8b9be108a723c4e7e7d7afe06fba6e77c58c2

Formbook

e509de8891799bcfa046e6bc48c4f5e9b11473ad0e5e61d0e895065776669388

Formbook

error

Formbook

f190d00b8327b3dbd653ad7aaacc15df1ccfdf4a4c780fe55249f3068df51fae

Formbook

+ 1'962 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/250611-e4hkzaxjz3/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e440d237-14de-4168-a2ff-c8d92dfb2b59

Unpacked files

SH256 hash:

65bcbf5fd47e0d3de349ea522b93b5564a143ce2a9f61693b6870ef14740bd63

MD5 hash:

b5c4935d686263a84a3bcdc69d5f725a

SHA1 hash:

8865f02fbcd9d23a406abe62cda9d288079ee041

Link:

https://www.unpac.me/results/e7777ea9-1372-4429-b6f0-93440a205ac0/

SH256 hash:

bef1fdb4a411c84a9e40aaeeba8c49c360451f7798817806d28cf2da5b78fc54

MD5 hash:

2942d4d1b9971116bf75a0fe11e7ba7a

SHA1 hash:

70b57df590754348a08d8dcb509bc24aebfcdafa

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/e7777ea9-1372-4429-b6f0-93440a205ac0/

SH256 hash:

d76e902d5fe0cf50e93c40c79c88a8cdd3e30de99f548dff7140ea00118e0e27

MD5 hash:

23002176265c7e35c24e41a67b43e16f

SHA1 hash:

80c193da6048b699b9a88abcc6ae6d15a33deeee

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/e7777ea9-1372-4429-b6f0-93440a205ac0/

Parent samples :

65bcbf5fd47e0d3de349ea522b93b5564a143ce2a9f61693b6870ef14740bd63
dd2c856d18e6b598654b821f3d3185ed8563a26e9e65a45676d4d7f869798d80
6de98d353d17a24ecee4a837b122624ed6438a7c1e205dc0b3c252a5e83b0103
921bb3d94777bf5e784a777d7cf8fe1a10b393781274229c7cb5c4228122e46a
750e4c5442535031a1e5637d2abed6ce126d8f0026b1431e936bac3d6ae45ce5

SH256 hash:

00383de0838a17a8d61ca4375fb8b275297337d6cce73afe108efa35018058fc

MD5 hash:

9850dea4433e133e33091b18c7a6bb32

SHA1 hash:

d739029a85827add4061388535457d264f22ac7c

Link:

https://www.unpac.me/results/e7777ea9-1372-4429-b6f0-93440a205ac0/

SH256 hash:

dc03fe83b88ecd1086340cf60835c034e6a1dc13538bc872ee54e5b62ea996d8

MD5 hash:

8d9f571c83edc271de7077347418d417

SHA1 hash:

ecf49ede1240ed0582260fd0943a5b1fff0b470c

Link:

https://www.unpac.me/results/e7777ea9-1372-4429-b6f0-93440a205ac0/

Malware family:

zgRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/65bcbf5fd47e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/65bcbf5fd47e0d3de349ea522b93b5564a143ce2a9f61693b6870ef14740bd63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/8879/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample