MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 19

Intelligence 19 IOCs YARA 17 File information Comments

SHA256 hash:	825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2
SHA3-384 hash:	aafa7d16369588bd779d250427780a46c2f21735f2e4e90ff7a7c5847b3821b970f7abc30b17a83a76643c33532251e6
SHA1 hash:	db8b14b1669aa00a3a34e99a84c056fb5ba841e8
MD5 hash:	0f36ce417e9315409983b6e99977f87b
humanhash:	california-nitrogen-six-fish
File name:	PO_NEW RQ.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'205'248 bytes
First seen:	2025-07-29 16:43:18 UTC
Last seen:	2025-08-12 14:44:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	24576:Xtb20pkaCqT5TBWgNQ7acocUvz9YdwBSKOdED91sop6A:UVg5tQ7acocuz9Dr9135
TLSH	T1CB45C01363DD8361C3B25273BA65B741BEBF782506B5F96B2FD8093DB820122521E673
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	James_inthe_box
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

_825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2.exe

Verdict:

Malicious activity

Analysis date:

2025-07-29 16:44:48 UTC

Tags:

autoit

Link:

https://app.any.run/tasks/a4c8d9be-1d49-4935-acd0-272cc61fbb02

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/17632/

Detection(s):

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6888fa2daf3050dc8d322405

Tags:

autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Sending a custom TCP request

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context autoit compiled-script evasive fingerprint fingerprint keylogger lolbin microsoft_visual_cc obfuscated packed packed packer_detected wuauclt

Link:

https://www.filescan.io/uploads/6888fa2e13488cfd44deba6d/reports/8cbdc271-2f53-4198-8e18-d81aa0d2a15e/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cbdfbbf6-100b-4347-aea6-b57fed4c067e

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2

Verdict:

Malware

YARA:

7 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/0f36ce417e9315409983b6e99977f87b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2/

Verdict:

Malicious

Threat:

VHO:Trojan-Spy.Win32.Noon

Link:

https://tip.neiki.dev/file/825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-07-29 10:34:02 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qjokzj3stsyzimwiprmbw2qweqgsd4ptsa5ydteydbf5qcvadxra._file

Verdict:

malicious

Label(s):

autoit

formbook

unc_loader_036

Similar samples:

error

Formbook

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/250729-t8er7szkz3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/13389eea-a546-4069-99b7-8ac170c96d34

Unpacked files

SH256 hash:

825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2

MD5 hash:

0f36ce417e9315409983b6e99977f87b

SHA1 hash:

db8b14b1669aa00a3a34e99a84c056fb5ba841e8

Link:

https://www.unpac.me/results/bdad1ed1-cd16-4699-87fe-a83b74e4d10d/

SH256 hash:

6d6e400a29e2dc8c6c5ede93e789f9e5ed22cc45ea342fcf6f2f808221a5818f

MD5 hash:

174dc227f18892598264cfc620797acf

SHA1 hash:

a9025d6850ebdc1e4987a25a9ec2799ac464c8fc

Link:

https://www.unpac.me/results/bdad1ed1-cd16-4699-87fe-a83b74e4d10d/

SH256 hash:

56f71a8da2d26dde4c2ca15d1b5ff22a39de7f09f2cfc84c6ebad75f26c31577

MD5 hash:

3388116e83535055a06384e1f9d97f96

SHA1 hash:

f749a3329d5628d35665dcaf848aea50025de554

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/bdad1ed1-cd16-4699-87fe-a83b74e4d10d/

Parent samples :

38e65102a6d8af117d96ba3159ab096d2b95ea8615408667997ce1375c00f35e
5bf3c820c4ed7b2b2e38dec099a4b76273a4e82472ced8f9cad59ba37b02dcb1
61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3
adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
adf664c4bba9af7873a7aa41ee0f2264e2757f14d8ac6619194572b58c1e7e68
2fbeb147acc6a400fdf52595966a38c61f6b323536d9a244de11067c9da57610
f0a905542b77b1e9d101dff1115070bffd1871f4c2ada0f3a95ee21081e8c671
3d4b7da0e29cdd7948064dd1a63fe86401240716d54ab1ef4d6e234e0b66807e
4857ee7f02efc4f90333790708097f4ad955beaaf41cdfe6ba11a5385a1ba8d5
2412e0910cc1deae89794bb142f6a0ec6089761fcace1f51f968b8f62bb19c32
34c4a7d2e16716cc0a9f9518718dd8efd2d36f97d2ee93721b9c2b40f4a164ce
cad6df3e9a9ac2d74b5c5276ab7192b8b876cde19259b8a567c80e44362e898f
f10a61792867b7b2d84daa851f8d24169a96cb70b55e09931a7ed2c01853634f
c3c235915752db934ca00b7c30cbcb2b5d83c2a52400ac29ccc1bd66573c534f
ad248905f0468cc57eacd8d3dadd474cd31a8b778c2a0eb952f48bdc525a1ee8
825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2
9ffbfc64827a32593bdcff306f45afaaa69cda089c1b3ed28a8889d17dbf33d0
76692d50ea8233a8ca9d3f9a89890d9a2149f0ff9859476920ed3ffc84c63f64
4caa9777053748e8ee0190b4056f93e1cc6506c212c06c67622c0cf6f476665b
a0cdffded083ccadb44b6b7841cd16580cf4638a573d2684134181dca7462d3a
6a11ab33aa16d2d8ba08cb3c6edb5e0613c1d459287261ecd907f9359068cbc8
b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
affbb0db85505a477fad583411e0361f0502ef4d9c46059da31ca85eb0e0b5d6
261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141
8c787bab18fce858e66ef04e233ec2e318503e250300628707bc833f23a79194
aa0227c6018d030ef8e31630cd92673ac3d30f7826a49059b4abfc26c77fd486
18af0ba21e4c33129d6a6774af76b2f09cf8ddf9e05fc9917c7b25a6e978e034

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/825caca7729c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/17632/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::CopySid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::GetAce
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoCreateInstanceEx ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::mciSendStringW WINMM.dll::timeGetTime WINMM.dll::waveOutSetVolume
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW ADVAPI32.dll::CreateProcessWithLogonW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW IPHLPAPI.DLL::IcmpCreateFile KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW ADVAPI32.dll::GetUserNameW ADVAPI32.dll::LogonUserW ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetAddConnection2W MPR.dll::WNetUseConnectionW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegConnectRegistryW ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::BlockInput USER32.dll::CloseDesktop USER32.dll::CreateMenu USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::FindWindowW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample