MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41cc50e5a5a905388164af38c9a7767211a0d2fe3f1a520cc3e6e2af51527558. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	41cc50e5a5a905388164af38c9a7767211a0d2fe3f1a520cc3e6e2af51527558
SHA3-384 hash:	9e3a84bb089ad137a99fcfb917b3e624078e08a3680d3eea81c984225a9d98f7e5d26fd0a74501a6d502636457a42410
SHA1 hash:	39d2bf90fdf62335008fa313bdc44f6333f211d8
MD5 hash:	4fd838ec9f2b71705db1a1d2c4da5c47
humanhash:	arkansas-blue-undress-fish
File name:	BL-SHIPPING INVOICE.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	340'205 bytes
First seen:	2023-07-07 07:18:06 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:9VDGs1FdEWtd/5qWJLh97lqkxUm7DariHAD4jVmDW0pRtYb:rD1zEOdhqS7kwUI2WHIW0ftk
TLSH	T16C74235CD7795C8C99FE62EC602E10E2AEFBEBE456F804A20580B3657713486E720DDD
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	FormBook INVOICE Shipping zip

cocaman

Malicious email (T1566.001)
From: "Cc: I-(LGL (sald) / SUWANNA_BDVL)<suwanna_bdvl@leogloballogistics.com>" (likely spoofed)
Received: "from [45.12.253.71] (unknown [45.12.253.71]) "
Date: "6 Jul 2023 16:18:31 +0200"
Subject: "=?UTF-8?B?UFJFLUFMRVJUIFNPI1NaUEE1OTI5MTcwMCAgSk9CI1NaWUMyMzAyMDY3Oe+8mkZPQiAvLyBTaGVuemhlbiB0byBJQ0QgVEtEIC8vICAxKjIwR1AgLy8gVG8gQWpheSBQb2x5IFB2dCBsdGQ=?="
Attachment: "BL-SHIPPING INVOICE.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	BL-SHIPPING INVOICE.exe
File size:	354'996 bytes
SHA256 hash:	f3a16fbf76dc776eb61b55b5a5aa8d3203e77effc2e05d85f93df96612323095
MD5 hash:	8630a6a245f55a441c08ca6f69cf540e
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL

Sanesecurity.Rogue.0hr.20230706-0334.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/41cc50e5a5a905388164af38c9a7767211a0d2fe3f1a520cc3e6e2af51527558/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

control formbook lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/64a7bc67784d6094d91a1941/reports/6d80ac89-f7f6-46a8-9a95-6a36ec82d9b1/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/41cc50e5a5a905388164af38c9a7767211a0d2fe3f1a520cc3e6e2af51527558

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/41cc50e5a5a905388164af38c9a7767211a0d2fe3f1a520cc3e6e2af51527558

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/41cc50e5a5a905388164af38c9a7767211a0d2fe3f1a520cc3e6e2af51527558/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-07-06 07:53:49 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ihgfbznfvectralev44mtj3woii2bux6h4nfedgd43rk6uksovma._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:s28y persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/230707-h5htxagh2y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Deletes itself

Loads dropped DLL

Formbook payload

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/41cc50e5a5a905388164af38c9a7767211a0d2fe3f1a520cc3e6e2af51527558

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 Create hunting rule
Author:	Florian Roth
Description:	Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:	https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg

Rule name:	SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:	https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg