MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10
SHA3-384 hash: e66c99948f785929e301bcc01ec74a995f5853cb239ef22ce5b987a2606a2a3a1b044fdf0263c1aaedf08cd70f68a09a
SHA1 hash: f4bda3ce1bfd4397866259dcfa3ae551d58e57ae
MD5 hash: 072ec75dfcb4bc9a307338d082fcacd1
humanhash: island-cold-hamper-jig
File name:xloader.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:294'400 bytes
First seen:2025-09-17 12:52:13 UTC
Last seen:2025-09-30 13:05:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:fui55dE0CEFP3DFOqWJfwe/6Uw2lM/gBwITaliMqdlv/+Va:/LdE0CS3DFOqefweE2VOImY
Threatray 1'198 similar samples on MalwareBazaar
TLSH T1AA54235D73085A7FD19C02B22C2771D8D4520B3B9F881B6B0E1AAE6FEF98230474562F
TrID 35.7% (.EXE) Win32 Executable (generic) (4504/4/1)
16.3% (.ICL) Windows Icons Library (generic) (2059/9)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.8% (.EXE) Generic Win/DOS Executable (2002/3)
15.8% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook gooder-bar

Intelligence

File Origin
# of uploads :
3
# of downloads :
104
Origin country :
US US
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
xloader.exe
Verdict:
Malicious activity
Analysis date:
2025-09-17 13:10:18 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/090b1809-873e-4fb5-8e72-30f4ec198f3a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/27915/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68caaf2688b95443924738b8
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
microsoft_visual_cc obfuscated overlay packed packed packer_detected
Link:
https://www.filescan.io/uploads/68caaf1ddbc6f5a29c49be19/reports/ecc16db2-121a-4b40-bf14-0661e8c988ef/overview
Verdict:
Malicious
Labled as:
Babar.Generic
Link:
https://www.hybrid-analysis.com/sample/cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-17T11:17:00Z UTC
Last seen:
2025-09-17T11:17:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/10ab29f0-8aa7-4f2e-878a-1cda06ee1b5a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/072ec75dfcb4bc9a307338d082fcacd1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-09-16 23:21:09 UTC
File Type:
PE (Exe)
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrsxrcylcxg64pu4d6p4nxkol3lnf5yurxxcz4dhczp2qlil3iia._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
120449b84850ba5b41e73f85e2f178271dd1cd0b8743f1e5af6ef760aa39b199
Formbook
1edf21b9bd2a882923fd14c0febaef2fa5676604dc4a515dbf54e4633c0b8dd2
Formbook
392ec2e0db217dc665b13c2e73b00d0ca2dc3b7f8a47eedf9a715d613e57a464
Formbook
47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5
Formbook
5546bd925d3a06f12ca0509af5db9539517039a2e3ba1f6f942b36f3e0115c8e
Formbook
674b492473c8055decf69d41cf511912178127b104a0aac346770cc919aff31a
Formbook
72e85d4b56147bbf739b9d717f2274a1a0bfb44188ba6d394e2829b8a4e024ed
Formbook
8e3ac942df072256abcf91e4f1e5c76a09093374a9f5b997905dfc5a8b949e2a
Formbook
error
Formbook
fe6b659e6a6d19470cf5cfb5dfef263d22119463a6d084c31006c24c0045bd72
Formbook
+ 1'188 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250917-p4habaxlw2/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/974edf1c-2cc9-4456-a929-b56d91774d9e
Unpacked files
SH256 hash:
cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10
MD5 hash:
072ec75dfcb4bc9a307338d082fcacd1
SHA1 hash:
f4bda3ce1bfd4397866259dcfa3ae551d58e57ae
Link:
https://www.unpac.me/results/a2aa62d3-76f3-41e0-9148-30d77d65faa9/
SH256 hash:
713e6ca13aa263d0f40a3e53f07fa12bfc83c356f9bd93c95f1f4f8af146c652
MD5 hash:
9cfa1597f1983ff148c787f7c14ee62f
SHA1 hash:
a7aa8f189a90939bce0ef73790196219629d4bb6
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/a2aa62d3-76f3-41e0-9148-30d77d65faa9/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cc65788b0b15/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/cc65788b0b15cdee3e9c1f9fc6dd4e5ed6d2f7148dee2cf067165fa82d0bda10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27915/

Comments