MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 19

Intelligence 19 IOCs YARA 20 File information Comments

SHA256 hash:	be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af
SHA3-384 hash:	e2856841157243328085efd6170ac3991223a4197c4270a8dc2179be6d9d0f0a539abbb7e3959f30b42f98a0b41f4429
SHA1 hash:	6f608eeed5d025363394ed3d02cfbbc8cc58f71c
MD5 hash:	4d11dd6d27d73911a2826dfe04ad6c5f
humanhash:	item-robert-don-october
File name:	be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af
Download:	download sample
Signature	Formbook Create hunting rule
File size:	794'624 bytes
First seen:	2025-09-05 12:41:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:bApcszAMinK5yNXJyL942ouxeaMvZ/V/0nYlRiQ437fo8OOKtMCVrd:EmlaRoAeaMRinYl8QaMhuCZ
Threatray	1'044 similar samples on MalwareBazaar
TLSH	T1D4F4F0B36B02D813EE644BB04872C7F812BE5F88A825E25B0CE5BD9B79371C33575295
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10522/11/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af

Verdict:

Malicious activity

Analysis date:

2025-09-05 15:45:29 UTC

Tags:

netreactor formbook xloader

Link:

https://app.any.run/tasks/c4738414-9532-423f-b67e-f8cf7795572e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/25408/

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68badac43e988eb6ab83c40f

Tags:

shell virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Sending a custom TCP request

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/68bae24d20d0ee406d96ac05/reports/0038c746-29f2-44b6-b8ec-a77ffd5406a2/overview

Verdict:

Malicious

Labled as:

Trojan.GenericS

Link:

https://www.hybrid-analysis.com/sample/be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-08-15T00:01:00Z UTC

Last seen:

2025-08-15T00:01:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/bd930b95-8184-4bcc-ad47-59b03619f99f

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.33 Win 32 Exe x86

Link:

https://app.malva.re/file/4d11dd6d27d73911a2826dfe04ad6c5f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af/

Threat name:

ByteCode-MSIL.Trojan.PureLogStealer

Status:

Malicious

First seen:

2025-08-15 08:33:15 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=x2mj5yw5yidcw42ihlxuc6g3wypnllfuovhlqzfsgdiyy7qxxcxq._file

Verdict:

malicious

Label(s):

unc_loader_037

Formbook

6ef10a2b79a761a18c6351d623cc52ef989a6ab06b37fdb07f5fb473b1c05c2b

Formbook

75346394a107950f00200cc98250dc265e7708d6833275bd0e4ce3645fd860ee

Formbook

8c0cd5bdae1355f8bc7f7af9102fb77eb8b52e432cdbe17c27456be4af1082ab

Formbook

a4e1ceb8458e0bca4119adb33ded5b1ef154f0ba69594b2079fbbcfb48cbe4ce

Formbook

+ 1'034 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/250905-qfr1aaxjz7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Formbook payload

Formbook

Formbook family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/496ff529-e993-4405-ad5e-6faf9e44c07e

Unpacked files

SH256 hash:

be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af

MD5 hash:

4d11dd6d27d73911a2826dfe04ad6c5f

SHA1 hash:

6f608eeed5d025363394ed3d02cfbbc8cc58f71c

Link:

https://www.unpac.me/results/eb34f46c-ff14-437c-8ab6-eb7e2b029960/

SH256 hash:

74a0e188e432790a87f90e712898baf02d9f7225aa029b9268908f32c99078ef

MD5 hash:

d29b624e6c72bfd8c8719c4d5039ddca

SHA1 hash:

2127437f696120349a4665995cedaa126538ba34

Link:

https://www.unpac.me/results/eb34f46c-ff14-437c-8ab6-eb7e2b029960/

SH256 hash:

0aa60cb0fe205b051a8e420965a0659ced419e3045455f72de5e1611a6e7f456

MD5 hash:

8e66a7bf7973c554cf3b103722cad9fe

SHA1 hash:

5b34e05b35c1d295e293bbd885438b88c8fd9670

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/eb34f46c-ff14-437c-8ab6-eb7e2b029960/

Parent samples :

e15bf322a7c587a47c91dad4734d8d56a941664ded7ddbd171416abeb1e34b47
c335602ef52f9260cfb20828515938d3c335abce3e459464d802d4c17d2fe8d7
3cb3401f42c9b3847e85aa6cdae6e981b576d289a21a6b7d166879e2b6ae5d6f
c5658d0585c94a50f715384ed28507806352107648eafa58fd7764a16c382244
4f8d01ea75f23293c5424e8b5a7f3f552c16d64f53d66b115f45648a04ecdd7d
be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af

SH256 hash:

5461ceddb7e084c4f13b5985b97f520052ad4a1c94b336df0dadec77d851967a

MD5 hash:

486b46e2e5d1b8dfad789101ce852fc4

SHA1 hash:

dc7b4c8b969f27713e13a1bec2960cf2d842a4c7

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/eb34f46c-ff14-437c-8ab6-eb7e2b029960/

SH256 hash:

cfdb32497616dcf3a5244d7f361f488411c2b28741d6e51ebf373c81c89869f1

MD5 hash:

ec27b49309c186ea83fef62f93a02fb7

SHA1 hash:

4087c82e6e0e8a821c389c7e5b7c615ee4bad6db

Link:

https://www.unpac.me/results/eb34f46c-ff14-437c-8ab6-eb7e2b029960/

Malware family:

zgRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/be989ee2ddc2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/be989ee2ddc2062b73483aef4178dbb61ed5acb4754eb864b230d18c7e17b8af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/25408/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample