MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bbe98f5455467226aa10e91db70f10b0b2cdf7f0d8ab07bba44aade384217a97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 16
| SHA256 hash: | bbe98f5455467226aa10e91db70f10b0b2cdf7f0d8ab07bba44aade384217a97 |
|---|---|
| SHA3-384 hash: | b8d288b069e23291be8e144bd4319ac61835a47a12263af457e786a94b990bf570748480611c99c8e5b2d2617774db85 |
| SHA1 hash: | 967584f4747ec61e48d2fd21c74752122240bd35 |
| MD5 hash: | 231c9e89aaae762ff5de74ae4add421d |
| humanhash: | solar-green-quiet-uranus |
| File name: | SecuriteInfo.com.Win32.MalwareX-gen.14526.25291 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 939'520 bytes |
| First seen: | 2025-06-09 13:26:19 UTC |
| Last seen: | 2025-06-09 15:04:54 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 24576:gEJ6OBSAOox/N31PvFOov9s+sSoLs4pqiez3VXCVc:kOBSUv31Pvt9sLs40JVe |
| Threatray | 12 similar samples on MalwareBazaar |
| TLSH | T12C15D004B35371D3C1BE337618A9D5B8197A5EF85E08BA12A2C3ADB3BCD915A03393D5 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | b2b68cb2b28cb6b2 (4 x Formbook, 2 x AgentTesla) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
453
Origin country :
FRVendor Threat Intelligence
Malware family:
formbook
ID:
1
File name:
SecuriteInfo.com.Win32.MalwareX-gen.14526.25291
Verdict:
Malicious activity
Analysis date:
2025-06-09 20:54:49 UTC
Tags:
netreactor formbook xloader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
90.2%
Tags:
shell micro spawn
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses threadpools to delay analysis
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
99%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Status:
Malicious
First seen:
2025-06-09 12:48:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 24 (79.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unc_loader_037
Similar samples:
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
bbe98f5455467226aa10e91db70f10b0b2cdf7f0d8ab07bba44aade384217a97
MD5 hash:
231c9e89aaae762ff5de74ae4add421d
SHA1 hash:
967584f4747ec61e48d2fd21c74752122240bd35
SH256 hash:
33dee089d982589938962ed90aeca6cc8a3e02d83cbc69bf2e5dcb9702b7c8ac
MD5 hash:
1a1b4105cd4d819495e3c7453452d841
SHA1 hash:
4d20d659561da570a299fcad97e34ecb85915c34
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
e60f9316d57d29f10fd160059e3fcc35a66249576aaf2e7e97c726f3a920bfe7
MD5 hash:
dba8246cf2fee2d927c4b5564badd788
SHA1 hash:
d3ddeafc8a5d40f3974819a1cc65a67d2dc4c45c
SH256 hash:
ed24f55e2c69d6905af28b428558f926ffe1859da19bb32535cb388f9d83a6d6
MD5 hash:
7e48fcdf6949ad5bbecbd154ad2e35bf
SHA1 hash:
fd214f8e6e8f25e99e1d6a1f23d7a7c39a39572c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
b089d63574927e20a3e6d5983cb3a902620733e4d03c2bc3beebcceb42bc7970
MD5 hash:
0519493ccb52ef986bf7bc399325d04f
SHA1 hash:
a1e0ec05f79d7e30be35e98dc95b03c66c4c8349
SH256 hash:
98d33fc01120929b9e5cf2f5e69ec9d952bbe64fba89d12e288a31bc05703c1f
MD5 hash:
efecf8e214bf484f7c39883b79496f5b
SHA1 hash:
1971e6ccf9bdf53c487d40d4b371decf18ff919a
Detections:
win_formbook_g0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | botnet_plaintext_c2 |
|---|---|
| Author: | cip |
| Description: | Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols. |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.