MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9368566ecd5ecfdc6a1a3b27386a8451412e1c1003cef4ef4b3418d56bdb703. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 4

Intelligence 4 IOCs YARA 8 File information Comments

SHA256 hash:	d9368566ecd5ecfdc6a1a3b27386a8451412e1c1003cef4ef4b3418d56bdb703
SHA3-384 hash:	02ac864c4dab25020bbe20c8e1c4a03e5536d8b1d437fe57607791aff3713d84439091eebc9af0ca86a45571a8e4423f
SHA1 hash:	ff413c31c5b2d4906728e90a25f2e9625d535395
MD5 hash:	23a44dcb8bdd2592fa369e30733e6771
humanhash:	ceiling-jupiter-robin-steak
File name:	OC 9851.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	740'686 bytes
First seen:	2025-07-07 08:35:49 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:tKU9Z2LLPQx1gSv5SE1KVLG0WOfF1uHpvfQIBftlJ1k/l7gM1KhofA/imOWJ6v3g:kS2YxiSv5SNU05fF1QQAt3WFt1Ke4//j
TLSH	T1B7F423835D5F55DE37AE270D99241693D17F4BDBAA02043A6449D102338AA3E1F3F2F6
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook rar

cocaman

Malicious email (T1566.001)
From: "David Matthysen <dm@vanderhaeghe.be>" (likely spoofed)
Received: "from vanderhaeghe.be (unknown [192.3.198.9]) "
Date: "03 Jul 2025 22:48:34 +0200"
Subject: "Quatation Request"
Attachment: "OC 9851.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	OC 9851.exe
File size:	867'848 bytes
SHA256 hash:	aed46d063084b9a653d25095dc8b3fffe4f741c0d1248ff54b7c2dca83ce89ab
MD5 hash:	e4b9d11dffc72628afa8355176c38482
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686b870c900df8e7f8682013

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d9368566ecd5ecfdc6a1a3b27386a8451412e1c1003cef4ef4b3418d56bdb703

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

.Net Executable PE (Portable Executable) Rar Archive SOS: 0.11

Link:

https://app.malva.re/file/23a44dcb8bdd2592fa369e30733e6771

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9368566ecd5ecfdc6a1a3b27386a8451412e1c1003cef4ef4b3418d56bdb703/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2025-07-03 19:43:38 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3e3ikzxm2xwp3rvbuozhhbviiukbfyobaa6o6txuwnay2vv5w4bq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/250707-knas3seq8v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d9368566ecd5ecfdc6a1a3b27386a8451412e1c1003cef4ef4b3418d56bdb703

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)