🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b387422d5a21b9ee9dc1f992b110415ce3754ede1ccc4ae73ba4dc7e7ae533cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b387422d5a21b9ee9dc1f992b110415ce3754ede1ccc4ae73ba4dc7e7ae533cd
SHA3-384 hash: 5e169aec0bffbf9c568487afefc943473f92b9c26ab924c477d45d15285aa2c2e80bfa9300d56a905df03cc18dcd72fe
SHA1 hash: 8cace964a6d12127d3eae5702e80f08fae6af1e9
MD5 hash: af3a1988f052525dd93e69fdc79d8a06
humanhash: lemon-minnesota-lithium-helium
File name:PO(1)1698376.vbs
Download: download sample
Signature Formbook
Create hunting rule
File size:37'181 bytes
First seen:2026-10-11 15:18:49 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:KJ6EDww5h+MyxM5gAX+TumfMD46QAJxzS/oPkM6:HqwCh+MZ5ga+WH1JZSAMM6
TLSH T1D8F221168F0F8BF019163566B7DB671BA910036578F879493A8BD18C3F7A5108BD3CEA
Magika vba
Reporter abuse_ch
Tags:FormBook vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91438/
Detection(s):
SecuriteInfo.com.VBS.DownLoader.4642.9259.26426.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6acba8f96cc0940bf51fa799/reports/36b7c95e-6919-4c45-9643-ff673abb7016/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b387422d5a21b9ee9dc1f992b110415ce3754ede1ccc4ae73ba4dc7e7ae533cd
Verdict:
Malicious
File Type:
vbs
First seen:
2026-10-09T22:17:00Z UTC
Last seen:
2026-10-13T13:32:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/b387422d5a21b9ee9dc1f992b110415ce3754ede1ccc4ae73ba4dc7e7ae533cd/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1985491
Signature
Excessive usage of taskkill to terminate processes
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Rundll32 Execution Without CommandLine Parameters
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1985491 Sample: PO(1)1698376.vbs Startdate: 11/10/2026 Architecture: WINDOWS Score: 100 100 www.70092104.xyz 2->100 102 sp.negrrwe.info 2->102 104 9 other IPs or domains 2->104 106 Suricata IDS alerts for network traffic 2->106 108 Multi AV Scanner detection for submitted file 2->108 110 Yara detected FormBook 2->110 114 7 other signatures 2->114 10 wscript.exe 1 2->10         started        13 4s8DDP1fBuvj.exe 2->13 injected 15 wscript.exe 2->15         started        17 8 other processes 2->17 signatures3 112 Performs DNS queries to domains with low reputation 100->112 process4 dnsIp5 144 VBScript performs obfuscated calls to suspicious functions 10->144 146 Wscript starts Powershell (via cmd or directly) 10->146 148 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->148 150 Suspicious execution chain found 10->150 20 powershell.exe 10->20         started        152 Maps a DLL or memory area into another process 13->152 154 Found direct / indirect Syscall (likely to bypass EDR) 13->154 23 rundll32.exe 13->23         started        156 WScript reads language and country specific registry keys (likely country aware script) 15->156 25 powershell.exe 15->25         started        94 www.70092104.xyz 142.0.134.52 PEG-SV-PEGTECHINCUS United States 17->94 96 www.fjp35.shop 207.57.236.136 ZILLION-NETWORK-ZillionNetworkIncUS Switzerland 17->96 98 4 other IPs or domains 17->98 27 powershell.exe 17->27         started        29 powershell.exe 17->29         started        31 powershell.exe 17->31         started        33 4 other processes 17->33 signatures6 process7 signatures8 126 Suspicious powershell command line found 20->126 128 Suspicious execution chain found 20->128 35 RegAsm.exe 20->35         started        38 powershell.exe 12 20->38         started        42 3 other processes 20->42 130 Tries to steal Mail credentials (via file / registry access) 23->130 132 Tries to harvest and steal browser information (history, passwords, etc) 23->132 134 Modifies the context of a thread in another process (thread injection) 23->134 136 Maps a DLL or memory area into another process 23->136 40 firefox.exe 23->40         started        45 5 other processes 25->45 47 5 other processes 27->47 49 5 other processes 29->49 51 5 other processes 31->51 53 14 other processes 33->53 process9 file10 116 Modifies the context of a thread in another process (thread injection) 35->116 118 Maps a DLL or memory area into another process 35->118 120 Queues an APC in another process (thread injection) 35->120 124 3 other signatures 35->124 55 wscript.exe 38->55         started        58 cmd.exe 1 38->58         started        60 conhost.exe 38->60         started        92 C:\ProgramData\aedbikm.vbs, ASCII 42->92 dropped 122 Suspicious powershell command line found 42->122 62 3 other processes 42->62 64 6 other processes 45->64 66 5 other processes 47->66 68 5 other processes 49->68 70 5 other processes 51->70 72 15 other processes 53->72 signatures11 process12 signatures13 138 Wscript starts Powershell (via cmd or directly) 55->138 140 WScript reads language and country specific registry keys (likely country aware script) 55->140 74 powershell.exe 55->74         started        142 Excessive usage of taskkill to terminate processes 58->142 76 taskkill.exe 1 58->76         started        78 3 other processes 58->78 80 4 other processes 62->80 82 8 other processes 64->82 84 8 other processes 66->84 86 8 other processes 68->86 88 8 other processes 70->88 90 19 other processes 72->90 process14
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b387422d5a21b9ee9dc1f992b110415ce3754ede1ccc4ae73ba4dc7e7ae533cd
Verdict:
Malware
YARA:
1 match(es)
Tags:
COM Behavior Trace DeObfuscated Obfuscated SOS: 0.64 T1027 T1059 T1059.005 VBScript WScript.Network WScript.Shell
Link:
https://app.malva.re/file/af3a1988f052525dd93e69fdc79d8a06
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b387422d5a21b9ee9dc1f992b110415ce3754ede1ccc4ae73ba4dc7e7ae533cd/
Threat name:
Script-WScript.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2026-10-10 09:03:25 UTC
File Type:
Text (VBS)
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=woduelk2eg465hob7gjlcecbltrxktw6dtgevzz3utoh46xfgpgq._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/7fa4f3f2-0bf7-4de4-a31e-f815134721e2
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/261011-sqb3xsa15x/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MULTI_Malware_GuLoader_ForgeAuto_2fbadefd
Create hunting rule
Author:Marjoriefort
Description:Detects GuLoader (inconnu, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91438/

Comments