MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 17

Intelligence 17 IOCs YARA 18 File information Comments

SHA256 hash:	bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad
SHA3-384 hash:	7d785c23a9bd6dbedc98da41ccdb49a9945dfcc3ba55cb9b22960829c6fe24d16028debb5a3afd66323d056f8fa1cb49
SHA1 hash:	fd9b9c4d724994b5954825dd0c0c7f857bfafda8
MD5 hash:	2fd133fcbf62cd6ed097986e7ec8426d
humanhash:	juliet-island-twenty-minnesota
File name:	bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad
Download:	download sample
Signature	Formbook Create hunting rule
File size:	764'416 bytes
First seen:	2025-12-08 15:47:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	21371b611d91188d602926b15db6bd48 (70 x Formbook, 33 x AgentTesla, 20 x RemcosRAT)
ssdeep	12288:kz7hU5I5yuNHIgzSFKxWltRohBfSTso93U4m4SjgZ4awXX8w4vihVXOdJR:kf+iN57Gtene3lmkEGiVXOZ
Threatray	2'216 similar samples on MalwareBazaar
TLSH	T1A1F401E0DF7518B5EC62533DB537AC262027BD69DD71080A63EDF3268D7238299E2907
TrID	39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	adrian__luca
Tags:	exe FormBook UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	764'416 bytes
File size (de-compressed) :	1'271'296 bytes
Format:	win32/pe
Unpacked file:	8c7cd6590e72250104c91c5dbff66bc376342ec4f0e870d913349db19ceacee4

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt PEPacker

Details

AutoIt

extracted scripts and files

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/83ea2488-83f3-4c96-8564-331332837bc8/

Malware family:

n/a

ID:

File name:

bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad

Verdict:

No threats detected

Analysis date:

2025-12-09 03:13:01 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b4e16673-6936-48ac-bed8-709c10067805

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/43680/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6936f384881313558a2b9996

Tags:

virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

DNS request

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-24T21:10:00Z UTC

Last seen:

2025-11-26T06:46:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad/results?tab=lookup

Gathering data

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/2fd133fcbf62cd6ed097986e7ec8426d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad/

Threat name:

Win32.Trojan.Swotter

Status:

Malicious

First seen:

2025-11-25 00:25:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xtdc4j3f2rg6ggvibsj4gu2ksdodeeejtwes7l7fhnwq2ply3wwq._file

Verdict:

malicious

Label(s):

formbook

Formbook

480eba71b028d39614cfb7d3f83e75358348d256f8d27e687a4a85ba7499a1a4

Formbook

4c43b309ba3f6388617f713f68150812c71bf42bbb6de40399082fca221bc336

Formbook

6e2c46144ecfe43364ca64844c46562391c994bac618e8c6e122922d14c64964

Formbook

911ab907376843edb05b47e615e37582276cc4af2b676727af7d61831d9fd044

Formbook

ea03b1c2d2aa3ec74bf4194c7f623670e13df20b4bfdaae11f2e8604521f77e4

Formbook

fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950

Formbook

+ 2'206 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan upx

Link:

https://tria.ge/reports/251208-s8xscazkep/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7e0288c8-e596-4961-85b5-1fde31c2ab6b

Unpacked files

SH256 hash:

8c7cd6590e72250104c91c5dbff66bc376342ec4f0e870d913349db19ceacee4

MD5 hash:

9d5c33f3c3e1ee5820857ca95432c334

SHA1 hash:

292776bb2825d1b89b602c92677877829489472b

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/dbba4e3a-49ba-4bdb-a86c-9484c5c342c9/

Parent samples :

bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad
8c7cd6590e72250104c91c5dbff66bc376342ec4f0e870d913349db19ceacee4

SH256 hash:

7bc02e40d267f0806ccbe4ddf692cf7e30e15aea70d7459a62be513ef77c43fa

MD5 hash:

64bb70052b94833bae8c6c2ed8355480

SHA1 hash:

3c5b9df2ff518b5026fa23510781e3d1cd15cd5a

Link:

https://www.unpac.me/results/dbba4e3a-49ba-4bdb-a86c-9484c5c342c9/

SH256 hash:

10923ea59dd5331d65d4c3c6f3b2affe4fe0a0327df3c318ca00ac14e593f33c

MD5 hash:

b2f4c247b5952aba37ea591d73e90d62

SHA1 hash:

f56579ede6c544ebe589959fc0f9b2476990bb62

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/dbba4e3a-49ba-4bdb-a86c-9484c5c342c9/

Parent samples :

4c43b309ba3f6388617f713f68150812c71bf42bbb6de40399082fca221bc336
44d76c2813cbcbbc38602cf85005884c492f6eb76fbdac3e8279633d75fc5a0d
480eba71b028d39614cfb7d3f83e75358348d256f8d27e687a4a85ba7499a1a4
a63518cd5599294dd399f039241d3447a0c23ef0fcefd13fd3fda953fde6dfa6
b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c
fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950
51fcf05f52722a269f61e188e92353ce667a5d50cfae39f98e58c5dda12836bf
d03d5c962c99335e1ca1701937074be95c015d8f7cf37828c178b35acbd99309
ea03b1c2d2aa3ec74bf4194c7f623670e13df20b4bfdaae11f2e8604521f77e4
6e2c46144ecfe43364ca64844c46562391c994bac618e8c6e122922d14c64964
02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00
d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e
bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad
8c7cd6590e72250104c91c5dbff66bc376342ec4f0e870d913349db19ceacee4
a7b250c97316686083cfa7c3d5c9aa35aeaa2090e4b27a7a2a88ab8986dc6b54

SH256 hash:

bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad

MD5 hash:

2fd133fcbf62cd6ed097986e7ec8426d

SHA1 hash:

fd9b9c4d724994b5954825dd0c0c7f857bfafda8

Link:

https://www.unpac.me/results/dbba4e3a-49ba-4bdb-a86c-9484c5c342c9/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bcc62e2765d4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	TH_Win_ETW_Bypass_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Windows ETW Bypass Detection Rule - 2025
Reference:	https://cyfare.net/

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Formbook

exe bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad

(this sample)

Formbook

exe 8c7cd6590e72250104c91c5dbff66bc376342ec4f0e870d913349db19ceacee4

Cape

https://www.capesandbox.com/analysis/43680/

Dropping

SHA256 8c7cd6590e72250104c91c5dbff66bc376342ec4f0e870d913349db19ceacee4

Dropping

MD5 9d5c33f3c3e1ee5820857ca95432c334

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample