MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b67699b51f8be9d00c98af074b971698a8984d1d3b5b6636ba7b287c8121b3ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 26 File information Comments

SHA256 hash:	b67699b51f8be9d00c98af074b971698a8984d1d3b5b6636ba7b287c8121b3ec
SHA3-384 hash:	e21ee576ed6df19da66c6cc51393b63696b817fa907368e78156fc7e7cbe5c25a5b1fcd7176d1d692abed6477852bc8a
SHA1 hash:	b75f969e21ef1b33f1e8b6c35b4ee0ab30a55db4
MD5 hash:	20b8b6c6bd1de5e20b782ce24b9f42ac
humanhash:	failed-jupiter-friend-jig
File name:	New Orders.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	712'655 bytes
First seen:	2025-08-27 11:57:49 UTC
Last seen:	2025-08-27 11:58:35 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:aGhUArWsWMlUEDUmAjtcgTULYauPqVFehnPoaalmaDcJZOt:JksWMlrZAegTULBFeBPox4b8
TLSH	T1BDE433552F0618B4213FAD04D297F1ABEC71744EB9F9AFE5792FA807F299197A700308
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook rar

cocaman

Malicious email (T1566.001)
From: "csdept@coreana.com.hk" (likely spoofed)
Received: "from coreana.com.hk (unknown [185.222.57.68]) "
Date: "18 Aug 2025 18:41:59 -0700"
Subject: "Re: URGENT: New Orders (PO#1164031)"
Attachment: "New Orders.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	New Orders.exe
File size:	737'792 bytes
SHA256 hash:	d877bae199bbc7c645d879095e9b1eae36fd04bda4c49ba47bb15a9d216cc5e6
MD5 hash:	ba4bd148c484e37c4d6ebd0223ff55eb
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68aef2e6eb163e0ec182ddc9

Tags:

autoit emotet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm anti-vm autoit compiled-script cscript lolbin masquerade microsoft_visual_cc packed packed packed phishing reg threat upx wscript

Link:

https://www.filescan.io/uploads/68aef2f31c81c34281d5375b/reports/e7c2ef00-3b59-4c43-801e-5f126b1a016b/overview

Verdict:

Malicious

Labled as:

Trojan.Downloader

Link:

https://www.hybrid-analysis.com/sample/b67699b51f8be9d00c98af074b971698a8984d1d3b5b6636ba7b287c8121b3ec

Verdict:

Malicious

File Type:

rar

First seen:

2025-08-19T03:13:00Z UTC

Last seen:

2025-08-19T03:13:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/b67699b51f8be9d00c98af074b971698a8984d1d3b5b6636ba7b287c8121b3ec/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b67699b51f8be9d00c98af074b971698a8984d1d3b5b6636ba7b287c8121b3ec/

Threat name:

Win32.Backdoor.FormBook

Status:

Malicious

First seen:

2025-08-19 16:54:33 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wz3jtni7rpu5adeyv4duxfywtcujqti5hnnwmnv2pmuhzajbwpwa._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan upx

Link:

https://tria.ge/reports/250827-pal2eazsbx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Formbook payload

Formbook

Formbook family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b67699b51f8be9d00c98af074b971698a8984d1d3b5b6636ba7b287c8121b3ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_formbook_g0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	win_upx_packed Create hunting rule
Author:	Reedus0
Description:	Rule for detecting UPX packed malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar b67699b51f8be9d00c98af074b971698a8984d1d3b5b6636ba7b287c8121b3ec

(this sample)

Formbook

exe d877bae199bbc7c645d879095e9b1eae36fd04bda4c49ba47bb15a9d216cc5e6

Delivery method

Distributed via e-mail attachment

Dropping

SHA256 d877bae199bbc7c645d879095e9b1eae36fd04bda4c49ba47bb15a9d216cc5e6

Dropping

Formbook

Dropping

MD5 ba4bd148c484e37c4d6ebd0223ff55eb

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample