MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 17

Intelligence 17 IOCs YARA 22 File information Comments

SHA256 hash:	c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38
SHA3-384 hash:	18b689319b3a1ff7790d3bfe8da678134492d7dd09b2225e5fbdb4b08af8fd28aa03be9e5ee05e1515d69b33e63e1a6f
SHA1 hash:	460d630eeb604473a3f1ab1f4f8ea54c1acf2fa2
MD5 hash:	e3f70a76561e6e1f489849ef37b363c9
humanhash:	whiskey-maryland-zulu-vermont
File name:	RFQ SATPL25-PO7488545..exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	837'632 bytes
First seen:	2025-09-09 13:13:39 UTC
Last seen:	2025-09-15 06:57:26 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:CMFnjrrZumIL3GfTIGF3QpMcb6UA4H444t:CMV/ZnIwkMc04H444t
Threatray	971 similar samples on MalwareBazaar
TLSH	T1D905018D7F14A971E414BEB59B05A730C09BAD41B220FF661DC076932EF66C4FB87A42
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

RFQ SATPL25-PO7488545..exe

Verdict:

Malicious activity

Analysis date:

2025-09-09 13:21:53 UTC

Tags:

netreactor auto-sch-xml formbook xloader stealer

Link:

https://app.any.run/tasks/6a782933-e568-4fb3-ad93-e2342372b4e1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/26487/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c0289c6e66ba602d7968c5

Tags:

virus micro msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/68c029b3cfa59bfdc7f58900/reports/00d766c3-508f-4071-980c-8f4d83ad5a71/overview

Verdict:

Malicious

Labled as:

Genie.8DN.Generic

Link:

https://www.hybrid-analysis.com/sample/c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-05T00:08:00Z UTC

Last seen:

2025-09-05T00:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38/results?tab=lookup

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a9ffd44a-6d3b-4217-918a-71b1de706b13

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.40 Win 32 Exe x86

Link:

https://app.malva.re/file/e3f70a76561e6e1f489849ef37b363c9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2025-09-05 03:01:13 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yo6odhfdf7sjtcem5qktbpxxag5d2eox7otxnfc2fyjelsywfi4a._file

Verdict:

malicious

Label(s):

unc_loader_037

Formbook

394052f1b64477e13f76845563cb611aaeb78fc8a153f262ec44326c9606d2c0

Formbook

446db8c0272f51979be2c65ad7ff221e5b00b3d3718a16cb2e6f7bd2f4003773

Formbook

52bd274cd1b0ada7597a4d72e78190d7b5574f0819204b4a3c0ac488256533ed

Formbook

833005a44107a2b32181f8a038fb7bc267df6648f0b94dc4a26cd295021b2cb7

Formbook

b0be564eb26f9cf2f58ea450d43194f3a4fb7dd2ca16375e3ecbfd636e5e7c13

Formbook

b27f17a52b7a491a0887307a8e4984f283b8076c1e49d535863068c51758c8bc

Formbook

b456996591120e1dddad01bcd6651f37ee3a30644d7ef77c3e41c21189615404

Formbook

c69a7800b5482d1e8e984e2e5ad548e057e1e9236e3ba937b167833e9c3302e2

Formbook

+ 961 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/250909-qk2qaaskz3/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1c3def7d-a4a5-43d6-a0b0-054607954c86

Unpacked files

SH256 hash:

c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38

MD5 hash:

e3f70a76561e6e1f489849ef37b363c9

SHA1 hash:

460d630eeb604473a3f1ab1f4f8ea54c1acf2fa2

Link:

https://www.unpac.me/results/22732626-c6fe-45b0-9386-07cd8dfa24ee/

SH256 hash:

3e674b562fe0906e2cd4769ba39466254cfeafb473d8900000dd42d47b5719bb

MD5 hash:

506336e740ccff4d4f5d5bc03bf83c0b

SHA1 hash:

43e9121ca476f98b0e629bca933eb9ebee10fe31

Link:

https://www.unpac.me/results/22732626-c6fe-45b0-9386-07cd8dfa24ee/

SH256 hash:

e50b0550616c4ea9dc2d18d75084f50e6e7da2ccaa2c77a439026957105aad8f

MD5 hash:

540148a4209d7e2b88d0e24b919c2834

SHA1 hash:

5a2042f9c9946e57d02d0d4e9a1ba2c5b1246a1e

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/22732626-c6fe-45b0-9386-07cd8dfa24ee/

Parent samples :

881aac6c0395e173fe15acd1baf9caf443e73e166176b5040ccdb7e34750ed58
e14543458bbd96f242cc1dbeb9e3ff8c62c592fbe954b6da75fbf7f05aa41a0f
93bba3622d1594eb97ea253dbee9a1d5c495871b73410bccd6c41d7969d3b8a2
a89d88037e6e7321b7da02290aab0139ddf7be1b697388dcc28fba708304682f
e2f435485baa82011fb87477cf73d40c87b87a3579b11ea8d3cb22883ad33682
67b1c7d222568af1d3fe24c18125eac63dad102e029fae7427b7b9a526f63699
2e3c410728b3564bd615f8e6c64a7fc82fd5385542d02d7134d07bcbbc3f9f09
8ece82ad36ddad1e13a955098ea9629364950ed21a1155d7be4921208e62eb0c
26a2714342c817548962d1a9cf5ebb1aacb811c3060fea1269c8280047b8eddf
78f8b46dfdd55f7914e78f925189180f674945327ee3fa9187e2d5de86b15337
a8dabe249da520a24de691d48bf2549dda65bbb3e62cecd148b1ff0080533cac
0cb006d7434c2ffa1b04e4f20a90688e8eb36e82cea2db1641744e235995439b
fcdc9e821a1bd97c87b1c9b9fed76a070f3ff81a0ee0838f49a915336851a029
6b76abca8f35fff263c12beaaf521405a1d3743abde3bc20d8415272b2c5a140
2f76a21937582bd59783cab01437d029a6ccd52635e2a3f424831ad7e444e640
392ec2e0db217dc665b13c2e73b00d0ca2dc3b7f8a47eedf9a715d613e57a464
acfd0a48223c3e021532b6f7cfb12e81ebf2903bd706b9a5d45fb1a020dd7902
9357bf9a67240b9df693123dfcefe78bd468a313243e9ab7769c60eae161f1ad
c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38
8e7c61db1d4aae49ddbd1ab8586fe752edbd01f30d5214e6e6bc074a3ec05588
a6fc6ac52bb2eb9fbe527ec26f3f21b8a3775660883ccd55976a250910dcee2e
227d7f535bcb6ce158d63d9436429547e9a065b289cf8b0caf8993ddd549190d

SH256 hash:

c9098d1cbef754c5027241c9bb463106ecc3a6abf1134d7afd6174c26ab65ec1

MD5 hash:

278d404cf7b8a220f2328f4c4dac9b27

SHA1 hash:

bda433311da8821960192d87009696b13c3c020f

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/22732626-c6fe-45b0-9386-07cd8dfa24ee/

SH256 hash:

0d9a7bd65a7b99d26081d42ea1b0362a273a6b7fbaa7be96d783b86e75cf4b86

MD5 hash:

1954acaa3f9a95bc9870a18817205af8

SHA1 hash:

8cb14f83c8ef2f5278aa8d9b2d7864b5cb50fe3a

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/22732626-c6fe-45b0-9386-07cd8dfa24ee/

Parent samples :

c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38
c90c85de9f7413b7ab31ddb5035a74d5d7e33cba90e9ce4585de7c659d27232b

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/26487/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample