MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 18

Intelligence 18 IOCs YARA 28 File information Comments

SHA256 hash:	9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84
SHA3-384 hash:	3f993a2a5b8637c38e8875ba51c2ef92342159e2205e395c58ed34f6864f05e84af10e00b7751fd289d6e98532fb98e0
SHA1 hash:	a25b4da8f86603d23baf1d57c293a1666ad2c27e
MD5 hash:	fb06fdc61d2ccb240274eec16b7fa228
humanhash:	burger-mobile-five-idaho
File name:	9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84
Download:	download sample
Signature	Formbook Create hunting rule
File size:	778'752 bytes
First seen:	2025-09-05 13:01:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:YaBXErmpa4Wy51Xq9qpDGh7nQNzmRZ44aBKAxXA1HJbNfKKvrYqnrD2bJq7Fd4h7:YqEK51XwCGhQzmz4fB9+1pbMKH+bJqhd
Threatray	756 similar samples on MalwareBazaar
TLSH	T148F4F19C3210F59FC45B9A318DA4EE74EA601CAA5707D303E1E72DEFB91D59B8E101E2
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

REQUESTFORQUOTATIONAUG20PROJECT009588767.exe

Verdict:

Suspicious activity

Analysis date:

2025-08-20 14:25:05 UTC

Tags:

netreactor

Link:

https://app.any.run/tasks/7d9b0f4a-f078-4405-bd25-4edc29017b02

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/25535/

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68badf46eb163e0ec18480ed

Tags:

virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated obfuscated obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/68bae992fe1969faa8a6c716/reports/38ec7cc6-be01-49fe-a64c-eae0e9362815/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-08-20T11:33:00Z UTC

Last seen:

2025-08-20T11:33:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84/results?tab=lookup

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fce65e6f-feed-461b-967e-15401d2d5d0a

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84/

Verdict:

Malicious

Threat:

Family.FORMBOOK

Link:

https://tip.neiki.dev/file/9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84

Threat name:

ByteCode-MSIL.Backdoor.FormBook

Status:

Malicious

First seen:

2025-08-20 14:25:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 38 (65.79%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=tpft4y63vkwmy3wrbppe5d4wwjsji52y2g7spukdwn7t6kiwnkca._file

Verdict:

malicious

Label(s):

unc_loader_037

Formbook

4824c73de2a144d3e4fbca50cb9fe2a81dda794258c6c9de45caf3572d17e145

Formbook

4da133b1ed7d9098b7b76b888472c069a08da9334cac292ea995c113d54812e3

Formbook

784ce0e82c852d420792062fc2370bfed13b8b846bbc126bfd5f6e3f5d1a2c67

Formbook

bd3cc153f4b3087bd7b7ae80996644097955b6ab7277e2a83165bda8554b8a91

Formbook

c69a7800b5482d1e8e984e2e5ad548e057e1e9236e3ba937b167833e9c3302e2

Formbook

cba5a4c3813bbce1dfd6591d94bdd59e773c33d06d4a534da0b3cb527f0a9f7b

Formbook

d89a76737ea433332fec51bc5662a0c87ed094e8dd6fcd9dd484377cc2ec5d88

Formbook

e2dc30f133c91cab67e24cebc23291f6953654e16d4ea2621dd64dd500c5cc9a

Formbook

+ 746 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/250905-q2qz4sxmz2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2d3d03da-4a93-4003-af6d-c9760c0e417c

Unpacked files

SH256 hash:

9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84

MD5 hash:

fb06fdc61d2ccb240274eec16b7fa228

SHA1 hash:

a25b4da8f86603d23baf1d57c293a1666ad2c27e

Link:

https://www.unpac.me/results/650fd89d-2739-4ba4-9793-c96edecff586/

SH256 hash:

27e5ffda53751e7360f380bd82a3176a7875a555f6af5b130fb2d64ff776c895

MD5 hash:

68845a1d0f6c65bb7ecc09ca76d2f005

SHA1 hash:

0145c4314c2cf41ae583bb32784fe780c1cdaf1d

Link:

https://www.unpac.me/results/650fd89d-2739-4ba4-9793-c96edecff586/

SH256 hash:

db299122557e685007a04277b4fda8ed3bc94db5337c6bf90c51692d1594a849

MD5 hash:

1ed5ae0de2cbabeb6e595ba2d216f2de

SHA1 hash:

2f45a066d95c7cb39d36ef59233a8b044b688899

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/650fd89d-2739-4ba4-9793-c96edecff586/

SH256 hash:

fc4b67409ffa1051ecb459d32e0bfdbcaf7c62e498430d0d56c23a3e3c27bff0

MD5 hash:

7211f34e2a294d0171119f9787ca7d18

SHA1 hash:

90f402d0b28a6a218ae75f262bca85ccec6bc400

Link:

https://www.unpac.me/results/650fd89d-2739-4ba4-9793-c96edecff586/

SH256 hash:

68c7f7fe5a4f84fb3b4c1c5249dd51f47003389ab4b8ec01a46c42058858cbdc

MD5 hash:

a705ebd576e3acc942df3fe13bf9171e

SHA1 hash:

c02538489c4107ca74a0ef16529f6edde1986ceb

Link:

https://www.unpac.me/results/650fd89d-2739-4ba4-9793-c96edecff586/

SH256 hash:

100320b51388dda1a4b3306d6a294222eb4d2dfe67f42f8490ce4e0c7fdc5b3a

MD5 hash:

e978b8e5272347c7c831368c87056830

SHA1 hash:

263bac811ca81aaf982dce0b92b8b38bfc59292e

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/650fd89d-2739-4ba4-9793-c96edecff586/

Parent samples :

fae04e1753cc051af6229b382defa6367e33075095c579249473f6f467cbccb1
3b8313decdeb72e5bc04326dcb9cedf06c1bcce618e5f65d84fe5f481f9af3c0
241d00dc87b5c01600a761460116e618505ecb4263f586ef5447b8c1d4329ebd
078cabe3f98bbf49468d898d869cd8f58df0ff0a1bddd9d00524ac49dd04f3af
cd96ca7a5b5ea72b4c03e9b2363296307ea826dc504c2dd54df89c3aeae94d5d
db2b7020233579fb99689c7e706545b2d7eefa8a83ef24160831c8fc982a1b4c
c5658d0585c94a50f715384ed28507806352107648eafa58fd7764a16c382244
fea19e2a8ec0ae79fb6f25deec6ac647a53027ee3d4861be780daf205d49a718
53b1100f0b09af2d37c8df2bcd77aaf844c4424bf17d71854a5d14130881ba10
3f3bedd484f8e49e35bd9e77b1ae88b27d5efc747a44dee28277be0556653ecb
62f63b180fc726bb6d54ecba4b3edb4436e2442953b07aea87c0e60cf057417f
9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84
6baa5a857ac8045ba485189e5098242a01946a00e35a7a541d7494562137aef1
5ee3dca8cae3f74a8d15e487328d1a33c28ca7098c747f2d50e4e5547d038474
928f36967f7a7af841021d4833479ec18178d48d9c418e772d0b3d32da7a2e6d

Malware family:

zgRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9bcb3e63dbaa/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/9bcb3e63dbaaaccc6ed10bde4e8f96b264947758d1bf27d143b37f3f29166a84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/25535/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample