MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b
SHA3-384 hash: e33928372e216b4df26991af3f13881425b16d0676a16e88c3b93b7fe841d175f3a1a73670fc531c6b0ddb3fca17155d
SHA1 hash: 8f028c1dea53e0405e613bd234c614bb80afe461
MD5 hash: a73e6ee2a0c448dd9cc5c2628357676c
humanhash: timing-asparagus-indigo-undress
File name:DHL - 1ST PAYMENT REMINDER - 1003634115.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'240'064 bytes
First seen:2026-02-27 17:16:53 UTC
Last seen:2026-03-02 08:15:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'863 x AgentTesla, 19'795 x Formbook, 12'305 x SnakeKeylogger)
ssdeep 24576:8GK5HxLWJiabrTejTVs5ZGvs++03G3umoSekBvP8PkNI5aOgA:8GAxLWJiaKjps5QQcIjFH2URA
Threatray 2'709 similar samples on MalwareBazaar
TLSH T1DF45D0E06744C826C56B42395872E6BB9533AE9EEC18C20D3DD9BF5B3E377020553A87
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 6cecccccb4c2f2b2 (38 x AgentTesla, 36 x Formbook, 24 x PythonStealer)
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
204
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
NETReactor RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c581691b-7a5c-43bd-a22f-a493b3bacd84/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
c24f933dab18a878b12a44517dbc51f26164e6a5d7d374123f7643f72638bf8c.rar
Verdict:
Malicious activity
Analysis date:
2026-02-26 05:01:01 UTC
Tags:
arch-exec formbook xloader stealer
Link:
https://app.any.run/tasks/21625e84-0a2a-4272-8c08-b0ff7a224cdc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/54924/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3463.21472.7166.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=699fd38b8fffa866e3b23a60
Tags:
malware
Verdict:
Malicious
Labled as:
Ser.Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b
Verdict:
Malicious
File Type:
exe x32
Detections:
Trojan-Spy.Noon.HTTP.ServerRequest PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Injuke.gen Backdoor.Agent.HTTP.C&C
Link:
https://opentip.kaspersky.com/b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b/results?tab=lookup
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e434b51a-febf-4f5a-8393-7f4f053920d7
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1876127
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1876127 Sample: DHL - 1ST PAYMENT REMINDER ... Startdate: 27/02/2026 Architecture: WINDOWS Score: 100 34 www.ardeno.xyz 2->34 36 www.xarimolent.help 2->36 38 14 other IPs or domains 2->38 46 Suricata IDS alerts for network traffic 2->46 48 Antivirus detection for URL or domain 2->48 50 Antivirus / Scanner detection for submitted sample 2->50 54 8 other signatures 2->54 11 DHL - 1ST PAYMENT REMINDER - 1003634115.exe 3 2->11         started        signatures3 52 Performs DNS queries to domains with low reputation 34->52 process4 file5 32 DHL - 1ST PAYMENT ... 1003634115.exe.log, ASCII 11->32 dropped 64 Injects a PE file into a foreign processes 11->64 15 DHL - 1ST PAYMENT REMINDER - 1003634115.exe 11->15         started        signatures6 process7 signatures8 66 Maps a DLL or memory area into another process 15->66 18 Qjqp7FB3Kuep.exe 15->18 injected process9 process10 20 icsunattend.exe 13 18->20         started        signatures11 56 Tries to steal Mail credentials (via file / registry access) 20->56 58 Tries to harvest and steal browser information (history, passwords, etc) 20->58 60 Modifies the context of a thread in another process (thread injection) 20->60 62 4 other signatures 20->62 23 RUcdhu0pJe.exe 20->23 injected 26 chrome.exe 20->26         started        28 firefox.exe 20->28         started        process12 dnsIp13 40 abititmuss.com 64.95.99.155, 49723, 49724, 49725 VOXEL-DOT-NETUS United States 23->40 42 www.ardeno.xyz 203.161.63.201, 49719, 49720, 49721 VNPT-AS-VNVNPTCorpVN Malaysia 23->42 44 12 other IPs or domains 23->44 30 WerFault.exe 4 26->30         started        process14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-02-26 03:35:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
50
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3mobvvdi3millo5kambmmandbzdyfhzitseii3bw47p4jn44kfq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
027b246202821c3564dcb1c7bdab3c76bbf77c5b98bb8d862616eb3352ed3fd1
Formbook
25230a687002161160427e213dcdd2a17ae50d9b3ba9679916e238b55b61a6d2
Formbook
479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
Formbook
5c0bdefeb2e965c9cb1aa42e28b84b31e11693b4438c47e97be98fb1b496d940
Formbook
6b15d702539c47fd54a63bda4d309e06d3c0b92d150f61c0b8b65eae787680be
Formbook
7f9d39908a024cc37cdece4ecc8aa724695ee2873d80ed4b1e7f8f8f3ee7ed5d
Formbook
85cffbf528025f8a8af7935e9e1ef285a9da23cb8f454b78143ab2960d339a15
Formbook
e5f1feba5c6cd56201fd5eb64c4d9dbfae827f756ebbfeda3cb51f453d465d1b
Formbook
error
Formbook
f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e
Formbook
+ 2'699 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260227-vtwmvaay8b/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b
MD5 hash:
a73e6ee2a0c448dd9cc5c2628357676c
SHA1 hash:
8f028c1dea53e0405e613bd234c614bb80afe461
Link:
https://www.unpac.me/results/bcd5efbc-bb52-4b15-b419-7a6c1e215cb9/
SH256 hash:
0bfd239d51a6f775f5157222246c02d0e72c31fb130f4e3722bfbf644bdee382
MD5 hash:
7ae9d31c959adb3b412a12acc34113b4
SHA1 hash:
0c23ad65dd5d670dc2af83cd74518ffa0357e01d
Link:
https://www.unpac.me/results/bcd5efbc-bb52-4b15-b419-7a6c1e215cb9/
SH256 hash:
3f8a50b8e1aafb988d189d2030f9e414d79032b751e282373a68f5cdeee17141
MD5 hash:
dc9ad3528a784756d9dc253b0f1f8f13
SHA1 hash:
19bebd9e96cd8dddbcab59c313d108623c4ef8b3
Link:
https://www.unpac.me/results/bcd5efbc-bb52-4b15-b419-7a6c1e215cb9/
SH256 hash:
b9ca0b7425372436777b4344e8564ce9c902ff0f53749c34d39a49cb252294e7
MD5 hash:
bc7b0914d0fa4c27bae747786b6b72d0
SHA1 hash:
7e10c5704b25b2b190fbfb990c43f17d598c2aec
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/bcd5efbc-bb52-4b15-b419-7a6c1e215cb9/
SH256 hash:
45f1a80a16259a4ca0add98c238445057a72702c1f0be70d31d9613020703f50
MD5 hash:
1b6146830d5464f1022fe7f25932ae0b
SHA1 hash:
420c581f60cbd3ec886153c857332a0ff94bd6f1
Link:
https://www.unpac.me/results/bcd5efbc-bb52-4b15-b419-7a6c1e215cb9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6d8e0d6a346d885addd501816300d18723c14f944e4442361b73efe25bce28b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:TH_Win_ETW_Bypass_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Windows ETW Bypass Detection Rule - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/54924/

Comments