🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07
SHA3-384 hash: b3e01b72ad6a736f044ba592c94f640b9f05d7cec1135816824161e023ec03a1494826592867ac954192a1874ff6a6fa
SHA1 hash: 26ee7f84e01751e892468a356e0bdf8188e9ceaf
MD5 hash: 787a6815a3cd7c3fa7d89b572450f79d
humanhash: happy-steak-glucose-georgia
File name:Purchase Order PO-580133429.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:820'224 bytes
First seen:2026-10-01 06:30:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'249 x AgentTesla, 20'536 x Formbook, 12'383 x SnakeKeylogger)
ssdeep 12288:c5X5xAMCGBpMkQ7jqANmnjb5cf2jWdb8jmWZ8Gwp2iVUvNTsFKN:BM7BpFQ3B4OmWdbzKbGUvNPN
TLSH T14605011433AACF06D9B607B81D30F37553BA6C4DA620D2578FE46DEB3935F9128186A3
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/dd946070-d755-40d6-826e-935c9e313fe9/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-01 06:43:39 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/16222360-0ae7-452a-837c-66dbb93b206e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/90012/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Blocking the Windows Defender launch
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-30T14:03:00Z UTC
Last seen:
2026-10-03T04:24:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7fef4df1-84e5-4b8a-b994-147d6ea9d8ff
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1980399
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1980399 Sample: Purchase Order  PO-580133429.exe Startdate: 01/10/2026 Architecture: WINDOWS Score: 100 30 www.supersloteasy.com 2->30 32 www.mamasy.info 2->32 34 14 other IPs or domains 2->34 42 Suricata IDS alerts for network traffic 2->42 44 Antivirus detection for URL or domain 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 10 other signatures 2->48 8 a77fMfCJ5.exe 2->8 injected 11 Purchase Order  PO-580133429.exe 4 2->11         started        signatures3 process4 dnsIp5 36 104.219.250.36, 49734, 49735, 80 NAMECHEAP-NET-NamecheapIncUS United States 8->36 38 www.mamasy.info 159.198.70.130, 49740, 49741, 49742 NAMECHEAP-NET-NamecheapIncUS United States 8->38 40 4 other IPs or domains 8->40 15 ReAgentc.exe 13 8->15         started        28 C:\...\Purchase Order  PO-580133429.exe.log, ASCII 11->28 dropped 50 Adds a directory exclusion to Windows Defender 11->50 18 Purchase Order  PO-580133429.exe 11->18         started        20 powershell.exe 23 11->20         started        22 Purchase Order  PO-580133429.exe 11->22         started        file6 signatures7 process8 signatures9 52 Tries to steal Mail credentials (via file / registry access) 15->52 54 Tries to harvest and steal browser information (history, passwords, etc) 15->54 56 Modifies the context of a thread in another process (thread injection) 15->56 64 2 other signatures 15->64 24 firefox.exe 15->24         started        58 Maps a DLL or memory area into another process 18->58 60 Queues an APC in another process (thread injection) 18->60 62 Found direct / indirect Syscall (likely to bypass EDR) 18->62 26 conhost.exe 20->26         started        process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.30 Win 32 Exe x86
Link:
https://app.malva.re/file/787a6815a3cd7c3fa7d89b572450f79d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2026-09-30 17:05:37 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3nd4j3rsbiq7nxopevceaoz24zml5xyyyfpcltzmtjfttphazqdq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery evasion execution rat spyware stealer trojan
Link:
https://tria.ge/reports/261001-g9qvms1cpa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Enumerates connected drives
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Modifies Windows Defender DisableAntiSpyware settings
Unpacked files
SH256 hash:
db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07
MD5 hash:
787a6815a3cd7c3fa7d89b572450f79d
SHA1 hash:
26ee7f84e01751e892468a356e0bdf8188e9ceaf
Link:
https://www.unpac.me/results/c34705b3-7762-4151-8bf6-2bd9ed4923f7/
SH256 hash:
3295f8799244fa214156c254f5f3aa451c51c7332d5dded363d920b1bb8d410c
MD5 hash:
15e75bb97c44782fed3ef51359d9d05f
SHA1 hash:
83467c9bf9cbe8c19c3cbf995f845c55e022f542
Link:
https://www.unpac.me/results/c34705b3-7762-4151-8bf6-2bd9ed4923f7/
SH256 hash:
67fcee692b5781c4ac6319d8c7c87153b4f47f0adbb008185676803095cd5e1c
MD5 hash:
875631dc3133ad0deebc419f98ee8606
SHA1 hash:
c529dc1cc5551070019a2f7d45f2285f0fe0a89a
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/c34705b3-7762-4151-8bf6-2bd9ed4923f7/
Parent samples :
f7914bc01cc7681047160cdb1c34d6cb548c16045cb4ef4a868de43f9b8f6844
6cd3384dcd0e66c10af0c54916d41afe61a4b9ab411e782d0764ae3a4119329c
fe0bc62c1859de201d59817578cc79ce2bcb5afdcc25682230e9e5e61c65a5ae
ace240c21c6b871239bc62b9f9824c49e192d15e2230c589682d93e989edd234
fcf5dbce80dd904652d4746dd6b26e34763cb07090573967ff6aa6c084496c16
c44dffc074ef6e0f7cada728769981cce25a9711cc8c9f185bf4f61c1907d741
3bb89c9e7eff35cd476e57b77412497cacd3833cf8d7f7139f6671a1284ac16c
e76c5c79066d31f5e84b172d61ba575926a18505efa47a9d9a0c7c1c0ced4768
786169a79bb505773566b041070dee3bb1c6ea67385acfc63ecf989ce701c87a
b4e22e21e205559a595d1e3b47516079d19bf9c226d41023494ed07f41648e65
db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07
4bfe304587633df9d042ede596f957bace69740c37bc40a6635cabe101802c65
da95e9481a7bf541617ce4197a1cb323f5abf266983a0d413121f6cc113c356b
96205f2b335e1de6f9904e4b5ac4b81c3a71dbde471a90e22eb80a5f9e55af9d
SH256 hash:
0039cd657b8168c31ae87e10085b2c8b461cc02b23fd1e7f21a764d6b4170883
MD5 hash:
2782c57ed6023595f38d0b42024d8a56
SHA1 hash:
448caa0e0f05c88042a6db7513488b1c92018ec3
Link:
https://www.unpac.me/results/c34705b3-7762-4151-8bf6-2bd9ed4923f7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/db47c4ee320a21f6ddcf2544403b3ae658bedf18c15e25cf2c9a4b39bce0cc07

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/90012/

Comments