MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 17

Intelligence 17 IOCs YARA 23 File information Comments

SHA256 hash:	bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4
SHA3-384 hash:	c1203fa0f936f6ea189c5fba7ba0250117c8c776b7a2d390fd62a70d33a89a49b422507562b82fd001cc7a69961aa4b3
SHA1 hash:	d46419a50e46228cbbfc294360673438cd864638
MD5 hash:	098860933410bc7881fb3214cbef71c2
humanhash:	robert-kilo-early-ohio
File name:	bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'649'664 bytes
First seen:	2026-10-19 07:52:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'361 x AgentTesla, 20'867 x Formbook, 12'418 x SnakeKeylogger)
ssdeep	49152:PtvcQnz/eFnmp2hVHHZioifL4xIGWJ42mQt/rxrbrqTQUlK:PxcQn8nmp2hVIorxxWJ4krxrbr3
TLSH	T1EA75E028052B4606D9F17FF51D71A1B0AB76ACA2B139C11A5ED60CEBB77BB003D4472B
TrID	72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.4% (.EXE) Win64 Executable (generic) (6522/11/2) 4.4% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
dhash icon	30f0ccccccccd4c4 (4 x Formbook, 1 x AgentTesla, 1 x XWorm)
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5bae940b-d0ef-4ca4-88f1-f5920ce09eea/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Suspicious activity

Analysis date:

2026-10-19 10:14:24 UTC

Tags:

auto-reg

Link:

https://app.any.run/tasks/fa1466b0-518e-440a-a003-a085329a9864

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/92737/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad5def15a22ac805bd7dce4

Tags:

virus msil cupi

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

Searching for synchronization primitives

Creating a window

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Launching a process

Creating a file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Forced shutdown of a system process

Adding an exclusion to Microsoft Defender

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-03T23:54:00Z UTC

Last seen:

2026-09-25T04:01:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4/results?tab=lookup

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dd42366e-88be-476a-9fa4-bf2018877f8f

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.30 Win 32 Exe x86

Link:

https://app.malva.re/file/098860933410bc7881fb3214cbef71c2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4/

Threat name:

ByteCode-MSIL.Trojan.DarkCloud

Status:

Malicious

First seen:

2026-09-04 14:09:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xprahokrdzavpvc6j3ahaooo6ie3hqin524b6cpplqqhwarpwpka._file

Verdict:

malicious

Label(s):

Formbook

Link:

https://reports.threatray.com/5009800d-9040-4a83-a61e-d5c4e2100584

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook adware collection defense_evasion discovery execution persistence privilege_escalation rat spyware stealer trojan

Link:

https://tria.ge/reports/261019-jqjy4agy3z/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

outlook_office_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Family: Formbook

Formbook payload

Unpacked files

SH256 hash:

bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4

MD5 hash:

098860933410bc7881fb3214cbef71c2

SHA1 hash:

d46419a50e46228cbbfc294360673438cd864638

Link:

https://www.unpac.me/results/dce52802-3ce5-4cfb-a041-412ef62c8e8e/

SH256 hash:

c99215c6a6bce1bf58ef13f108a09e070b13eaa98ede76ba2f53b713d9c3cac8

MD5 hash:

46cbc445b546b2fa5991c0db6fba9bc2

SHA1 hash:

5269193200e808e0b536d12bc68d4078dd037b2e

Link:

https://www.unpac.me/results/dce52802-3ce5-4cfb-a041-412ef62c8e8e/

SH256 hash:

d39ccd9c026313167222d964def426a3f62d9a7739804af9894b1cde2a1c367f

MD5 hash:

a57235731d52c94d2f1c62a4eb4c8062

SHA1 hash:

ce95d053ec00409fe1d000c03088e4a063cc6acf

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

Link:

https://www.unpac.me/results/dce52802-3ce5-4cfb-a041-412ef62c8e8e/

SH256 hash:

22022adde7f7d8807d5444e1433a6d8210ae50fb02b98145618cb3f6827c8a63

MD5 hash:

aedbc9a35b43a7835a00fcb3dfca8c6e

SHA1 hash:

543c58860904fe57fc2de640d9ab31fc124cac14

Link:

https://www.unpac.me/results/dce52802-3ce5-4cfb-a041-412ef62c8e8e/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bbe203b9511e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bbe203b9511e4157d45e4ec07039cef209b3c10deeb81f09ef5c207b022fb3d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	TH_Win_ETW_Bypass_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Windows ETW Bypass Detection Rule - 2025
Reference:	https://cyfare.net/

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/92737/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample