MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4cf2fe821d34bd5cd8e937cd244df0d406d7fc6d5889dd41a19111d37230ece. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4cf2fe821d34bd5cd8e937cd244df0d406d7fc6d5889dd41a19111d37230ece
SHA3-384 hash: ae7a8e234c58787f22e6d0cd3b5a31cfa4a8d8485b423f9b1e04e389c8293d6013b07008ebc30a172710ab48fb5866c8
SHA1 hash: 3d0f0318dd62bbafeeeacdb83a9ba9f0dbd33732
MD5 hash: 3ce05609642ec396f7f77753f8b07e35
humanhash: mockingbird-uranus-magnesium-tennessee
File name:la.ps1
Download: download sample
Signature Formbook
Create hunting rule
File size:123'765 bytes
First seen:2025-06-13 12:18:17 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3072:2DR8AtQAnQHU91QyEwOuhv4MYy0Cu3MFcrEMJ3Ig10WEAA5:2iB07QTMAvyJz5U3x10We
Threatray 6 similar samples on MalwareBazaar
TLSH T17CC312783D79DD988180B24B627EC97C8445C776E2C8FFCF63276A872047618666C8B7
Magika powershell
Reporter juroots
Tags:FormBook ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
IL IL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PowerShell.MulDrop.432.7747.192.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684c17598bd5d68a12e8781f
Tags:
downloader trojan extens
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f4cf2fe821d34bd5cd8e937cd244df0d406d7fc6d5889dd41a19111d37230ece
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1714074
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
AI detected malicious Powershell script
Allocates memory in foreign processes
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Powershell drops PE file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Suspicious execution chain found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1714074 Sample: la.ps1 Startdate: 13/06/2025 Architecture: WINDOWS Score: 100 45 www.mj222.xyz 2->45 47 www.1candi88.xyz 2->47 49 3 other IPs or domains 2->49 55 Suricata IDS alerts for network traffic 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 Multi AV Scanner detection for submitted file 2->59 63 6 other signatures 2->63 11 powershell.exe 22 2->11         started        15 svchost.exe 1 1 2->15         started        signatures3 61 Performs DNS queries to domains with low reputation 47->61 process4 dnsIp5 37 C:\Users\user\AppData\Local\...\FnLoQWeB.exe, PE32 11->37 dropped 75 Suspicious execution chain found 11->75 77 Found suspicious powershell code related to unpacking or dynamic code loading 11->77 79 Powershell drops PE file 11->79 18 FnLoQWeB.exe 15 3 11->18         started        22 conhost.exe 11->22         started        53 127.0.0.1 unknown unknown 15->53 file6 signatures7 process8 dnsIp9 51 172.245.123.11, 49692, 80 AS-COLOCROSSINGUS United States 18->51 65 Multi AV Scanner detection for dropped file 18->65 67 Writes to foreign memory regions 18->67 69 Allocates memory in foreign processes 18->69 71 Injects a PE file into a foreign processes 18->71 24 RegAsm.exe 18->24         started        signatures10 process11 signatures12 73 Maps a DLL or memory area into another process 24->73 27 gKQjgJ8gzNAMQ.exe 24->27 injected process13 process14 29 SecEdit.exe 13 27->29         started        signatures15 81 Tries to steal Mail credentials (via file / registry access) 29->81 83 Tries to harvest and steal browser information (history, passwords, etc) 29->83 85 Modifies the context of a thread in another process (thread injection) 29->85 87 3 other signatures 29->87 32 amO6YfyC85lbtu.exe 29->32 injected 35 firefox.exe 29->35         started        process16 dnsIp17 39 www.mj222.xyz 103.21.220.227, 49710, 49711, 49712 LINKNET-ID-APLinknetASNID unknown 32->39 41 www.reims.delivery 199.59.243.228, 49706, 49707, 49708 BODIS-NJUS United States 32->41 43 2 other IPs or domains 32->43
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f4cf2fe821d34bd5cd8e937cd244df0d406d7fc6d5889dd41a19111d37230ece
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4cf2fe821d34bd5cd8e937cd244df0d406d7fc6d5889dd41a19111d37230ece/
Threat name:
Script-PowerShell.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-06-13 00:54:05 UTC
File Type:
Text (PowerShell)
AV detection:
13 of 38 (34.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ths72bb2nf5ltmosn6nerg7bvag276g2wej3va2deir2nzdb3ha._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
fantomcrypt
Create hunting rule
Similar samples:
2e64ed10f0c61a872dbc4cc8ac023e947db0c9642044dbe33af671cff97135a0
Formbook
488fd01b48843bf68389e2afad9b7e85086db28baa156ad753f4408e6002e06c
Formbook
ca4a2cb8318f38fc80d893a39cf9484eb1d9080ce43277e85ea6d1e69f7674d5
Formbook
d62492b97578c65dd676972d9618686e2859092a9540ff1763ba65d666ca3f6c
Formbook
error
Formbook
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250613-pg3bzayve1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Downloads MZ/PE file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f4cf2fe821d34bd5cd8e937cd244df0d406d7fc6d5889dd41a19111d37230ece

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

PowerShell (PS) ps1 f4cf2fe821d34bd5cd8e937cd244df0d406d7fc6d5889dd41a19111d37230ece

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3561756/
  
Delivery method
Distributed via web download

Comments