🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7eb8fc5454938505305cf577cb9936f328b1cdb8d74e8b470377a27834d10e00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7eb8fc5454938505305cf577cb9936f328b1cdb8d74e8b470377a27834d10e00
SHA3-384 hash: 9e7368571d906be4956c208bd350c9e784b3007db75c0f6c831c26bffa0de3d83aa9f2151239940c20d2c354980eb248
SHA1 hash: 55567cc10a1fadce2b105cbc3859342c8be0b0d7
MD5 hash: 50148f1ad1230114342a561378b40804
humanhash: cold-lima-river-finch
File name:Purchase order-269374 Image.bat
Download: download sample
Signature Formbook
Create hunting rule
File size:27'456 bytes
First seen:2026-10-15 08:51:22 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 384:foh8GsAJbD5ZAyJFeOldMMqvaqD+1LR5XYDPcLawToh8GsAJbD5ZAyJFeOldMMqy:fou3Bc5qq9sPAJou3Bc5qq9sPATp
TLSH T19AC219BAD2873480859393D1B0D9D0C2B147EC176E8F695977BC4A406B967F0B3E9CC9
Magika batch
Reporter lowmal3
Tags:bat FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
bat
Verdict:
Malicious activity
Analysis date:
2026-10-15 09:00:03 UTC
Tags:
opendir stego payload susp-powershell
Link:
https://app.any.run/tasks/5d4c4e96-a3a0-481b-8af6-655f877af2e2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/92137/
Detection(s):
SecuriteInfo.com.BAT.DownLoader.1424.22869.25626.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad19f7d6f551121ba1673fc
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file
Creating synchronization primitives
Sending an HTTP GET request to an infection source
Sending a custom TCP request
Launching a process
Running batch commands
Searching for the window
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Connection attempt to an infection source
Setting a single autorun event
Launching a tool to kill processes
Query of malicious DNS domain
Sending a TCP request to an infection source
Using obfuscated Powershell scripts
Unauthorized injection to a system process
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/7eb8fc5454938505305cf577cb9936f328b1cdb8d74e8b470377a27834d10e00
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-15T01:23:00Z UTC
Last seen:
2026-10-17T07:26:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/7eb8fc5454938505305cf577cb9936f328b1cdb8d74e8b470377a27834d10e00/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1987446
Signature
Excessive usage of taskkill to terminate processes
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Mass process execution to delay analysis
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Rundll32 Execution Without CommandLine Parameters
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected FormBook
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1987446 Sample: Purchase order-269374 Image.bat Startdate: 15/10/2026 Architecture: WINDOWS Score: 100 115 www.70092104.xyz 2->115 117 norisprotectionjb.com 2->117 119 12 other IPs or domains 2->119 129 Suricata IDS alerts for network traffic 2->129 131 Multi AV Scanner detection for submitted file 2->131 133 Yara detected FormBook 2->133 137 7 other signatures 2->137 11 cmd.exe 1 2->11         started        14 wAxVE0TS.exe 2->14 injected 16 cmd.exe 1 2->16         started        18 17 other processes 2->18 signatures3 135 Performs DNS queries to domains with low reputation 115->135 process4 dnsIp5 161 Suspicious powershell command line found 11->161 163 Mass process execution to delay analysis 11->163 21 powershell.exe 11->21         started        24 conhost.exe 11->24         started        165 Found direct / indirect Syscall (likely to bypass EDR) 14->165 26 rundll32.exe 13 14->26         started        28 powershell.exe 16->28         started        30 conhost.exe 16->30         started        121 www.70092104.xyz 142.0.134.52 PEG-SV-PEGTECHINCUS United States 18->121 123 www.fjp35.shop 207.57.236.136 ZILLION-NETWORK-ZillionNetworkIncUS Switzerland 18->123 125 6 other IPs or domains 18->125 32 powershell.exe 18->32         started        34 powershell.exe 18->34         started        36 powershell.exe 18->36         started        38 29 other processes 18->38 signatures6 process7 signatures8 139 Suspicious powershell command line found 21->139 141 Suspicious execution chain found 21->141 143 Mass process execution to delay analysis 21->143 40 powershell.exe 21->40         started        145 Tries to steal Mail credentials (via file / registry access) 26->145 147 Tries to harvest and steal browser information (history, passwords, etc) 26->147 149 Modifies the context of a thread in another process (thread injection) 26->149 151 Maps a DLL or memory area into another process 26->151 42 firefox.exe 26->42         started        44 powershell.exe 28->44         started        46 powershell.exe 32->46         started        48 powershell.exe 34->48         started        50 powershell.exe 36->50         started        52 powershell.exe 38->52         started        54 powershell.exe 38->54         started        56 11 other processes 38->56 process9 process10 58 RegAsm.exe 40->58         started        61 2 other processes 40->61 63 3 other processes 44->63 65 3 other processes 46->65 67 3 other processes 48->67 69 3 other processes 50->69 71 3 other processes 52->71 73 3 other processes 54->73 75 29 other processes 56->75 signatures11 153 Modifies the context of a thread in another process (thread injection) 58->153 155 Maps a DLL or memory area into another process 58->155 157 Queues an APC in another process (thread injection) 58->157 159 3 other signatures 58->159 77 cmd.exe 1 61->77         started        80 conhost.exe 61->80         started        82 2 other processes 63->82 84 2 other processes 65->84 86 2 other processes 67->86 88 2 other processes 69->88 90 2 other processes 71->90 92 2 other processes 73->92 94 18 other processes 75->94 process12 signatures13 167 Excessive usage of taskkill to terminate processes 77->167 96 taskkill.exe 1 77->96         started        99 3 other processes 77->99 101 4 other processes 82->101 103 4 other processes 84->103 105 4 other processes 86->105 107 4 other processes 88->107 109 4 other processes 90->109 111 4 other processes 92->111 113 36 other processes 94->113 process14 signatures15 127 Suspicious powershell command line found 96->127
Score:
83%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7eb8fc5454938505305cf577cb9936f328b1cdb8d74e8b470377a27834d10e00
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7eb8fc5454938505305cf577cb9936f328b1cdb8d74e8b470377a27834d10e00/
Threat name:
Script-BAT.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-10-15 08:52:21 UTC
File Type:
Text (Batch)
AV detection:
2 of 36 (5.56%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p24pyvcusocqkmc46v34xgjw6muldtny25hiwrydo6rhqngrbyaa._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/a7c42e48-bf5b-4e15-af12-355bb61baa6f
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/261015-kswlcah181/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7eb8fc5454938505305cf577cb9936f328b1cdb8d74e8b470377a27834d10e00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:obfuscated_BAT
Create hunting rule
Author:@warz_s
Description:Identifies obfuscated BAT files
Reference:https://github.com/secwarz/YaraRules

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/92137/

Comments