MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641
SHA3-384 hash: aee080534257ebda1905d573d475939174ca66485aa105cad67c3dae1c1e1a7baae2a1ffb44ecb9e112b4be697feb5f7
SHA1 hash: bcd13ed8a372e6834e580c95a6f19360cd24af3f
MD5 hash: c2960ffbe8e2b844eb23f4d35ca742e0
humanhash: carbon-spaghetti-illinois-maine
File name:RFQ New Order - 57m³ LPG SEMI TRAILER 7 NOS.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:728'064 bytes
First seen:2024-07-23 12:44:29 UTC
Last seen:2024-07-23 13:27:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:14ndmoHtPJiWM3aqk3WFf+63o830bYlt8kmEn:2nghWMNcWFf+a0bYX8O
Threatray 873 similar samples on MalwareBazaar
TLSH T150F4CF5537E405A8D53E89BAE8F240796A30785266E2DCA112CF1FC9BCCFF61498325F
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
340
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2944.8895.25791.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=669fa5eb2f6eaff4b90f4da4
Tags:
Generic Msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e822043d-9f2f-4544-a597-7169ad9fd4bc
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1479367
Signature
.NET source code references suspicious native API functions
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1479367 Sample: RFQ New Order - 57m#U00b3 L... Startdate: 23/07/2024 Architecture: WINDOWS Score: 100 32 www.exadata.com 2->32 34 www.cradunk.com 2->34 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FormBook 2->46 48 4 other signatures 2->48 10 RFQ New Order - 57m#U00b3 LPG SEMI TRAILER 7 NOS.exe 3 2->10         started        signatures3 process4 file5 30 RFQ New Order - 57...AILER 7 NOS.exe.log, ASCII 10->30 dropped 13 RFQ New Order - 57m#U00b3 LPG SEMI TRAILER 7 NOS.exe 10->13         started        process6 signatures7 60 Maps a DLL or memory area into another process 13->60 16 tWUdcGBsHpf.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 ktmutil.exe 13 16->19         started        22 Magnify.exe 16->22         started        process10 signatures11 50 Tries to steal Mail credentials (via file / registry access) 19->50 52 Tries to harvest and steal browser information (history, passwords, etc) 19->52 54 Modifies the context of a thread in another process (thread injection) 19->54 56 3 other signatures 19->56 24 tWUdcGBsHpf.exe 19->24 injected 28 firefox.exe 19->28         started        process12 dnsIp13 36 www.cradunk.com 104.21.41.159, 49748, 80 CLOUDFLARENETUS United States 24->36 38 www.exadata.com 199.59.243.226, 49749, 49750, 49751 BODIS-NJUS United States 24->38 58 Found direct / indirect Syscall (likely to bypass EDR) 24->58 signatures14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-07-17 08:16:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hipxcsst3aylupljuxohigjmxs62svhd2kzejzozlp6roel7yzaq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
35aa094ef5e31708b49d5128ab5a7c05bdc71af43dd605f9140d71c396528929
Formbook
3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641
Formbook
41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95
Formbook
79c7358a9ac82f4d547e027ec64b8a9854ef445ff7d1e85a2b39c0e60bc00c99
Formbook
d1fcbf364ad31af81a9612d9633e1b6598375983354390bfaa32b5ea5a7c3a6d
Formbook
d8e6a83561b9d8dbe84de21795763589d2626904ac6406ddfe2dc2342c4edb8e
Formbook
+ 863 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240723-py4lcszgmj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e4f0835f-6cff-4309-a157-4ae2bb774489
Unpacked files
SH256 hash:
76ecfc5234932c8f0947fe821fd2da6d36430557335e1fa2839a9851391b4ac6
MD5 hash:
3947ed4dd6828ef7731f0b5f9e90d03d
SHA1 hash:
8eaa2a7735015366cd1beea698d4499924c59a7c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Link:
https://www.unpac.me/results/c0567f5c-3057-471f-901a-a48dbf294ac5/
SH256 hash:
d6e1c5c3563508558e52f01da1ebe99f686789184f25abe129f5f3d21df38842
MD5 hash:
2ff36e30777c5eb2597d1434d714f95d
SHA1 hash:
e8950f6eed4a268d4aa26901fdd582e6cc5455a2
Link:
https://www.unpac.me/results/c0567f5c-3057-471f-901a-a48dbf294ac5/
SH256 hash:
1b4db5203d1b363b24b8dfa86fd998703147e9ed65cceaa174c2faf519a2fd71
MD5 hash:
503babd7337c511d77ca3f961d452164
SHA1 hash:
dff750f70bd875df2c4e66a13b99b2041e2710cd
Link:
https://www.unpac.me/results/c0567f5c-3057-471f-901a-a48dbf294ac5/
SH256 hash:
45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b
MD5 hash:
fb1bc19121c4e190d83672bc71b493f0
SHA1 hash:
c3488b969ba578e28ee360be24b6416425a224a0
Link:
https://www.unpac.me/results/c0567f5c-3057-471f-901a-a48dbf294ac5/
SH256 hash:
3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641
MD5 hash:
c2960ffbe8e2b844eb23f4d35ca742e0
SHA1 hash:
bcd13ed8a372e6834e580c95a6f19360cd24af3f
Link:
https://www.unpac.me/results/c0567f5c-3057-471f-901a-a48dbf294ac5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 3a1f714a53d830ba3d69a5dc74192cbcbda954e3d2b244e5d95bfd17117fc641

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments