MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 553e1b3e0681bff4b2e85cefba1ea7ed48c5161c682f8fe3e5346a266b2b2c7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	553e1b3e0681bff4b2e85cefba1ea7ed48c5161c682f8fe3e5346a266b2b2c7d
SHA3-384 hash:	fd4f1832afe042b7b10fe4d033af829e7559359a4c23ac7c9227ed743bf4fd48fe5b83a7e8a540418d7b9cf5ed979ea5
SHA1 hash:	3a25e3b33e3447ba45e08c33d9f66294f32d75eb
MD5 hash:	714b07a7853bbd40899905e1eed3ef9c
humanhash:	mango-april-paris-mirror
File name:	REVISED PURCHASE ORDER.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	812'023 bytes
First seen:	2023-02-08 11:40:39 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:OC6SVdP6AD0Z5PiO+rW/HqAcpeaCywDUVLbP76Z:OCf99reqxdz9fK
TLSH	T13F0533D12AAB3D69B906C280EFE748440CE42DCB47A75CDBE1FE7A7590357C71109A2A
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	FormBook rar

cocaman

Malicious email (T1566.001)
From: "Alice Ai <alice@jhunthome.com>" (likely spoofed)
Received: "from jhunthome.com (unknown [185.222.58.242]) "
Date: "7 Feb 2023 12:10:28 +0100"
Subject: "=?UTF-8?B?5Zue5aSNOlJFOiBSRVZJU0VEIFBVUkNIQVNFIE9SREVSIElURU1TIDIwMjMtMTQtMzE=?="
Attachment: "REVISED PURCHASE ORDER.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	REVISED PURCHASE ORDER.exe
File size:	934'912 bytes
SHA256 hash:	686802626b55d584dba9bb97f1a9c6b61cdb1f56ab9362cb57b333109ed3a486
MD5 hash:	41ab5bbead147ca7db73d398076e3fd9
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/553e1b3e0681bff4b2e85cefba1ea7ed48c5161c682f8fe3e5346a266b2b2c7d/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

67%

Tags:

packed

Link:

https://www.filescan.io/uploads/63e38a5089bd67c10fdd48b9/reports/be8af0bb-89f5-44d8-935b-00823ca04d52/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/553e1b3e0681bff4b2e85cefba1ea7ed48c5161c682f8fe3e5346a266b2b2c7d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/553e1b3e0681bff4b2e85cefba1ea7ed48c5161c682f8fe3e5346a266b2b2c7d/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-02-07 10:12:07 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 39 (41.03%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ku7bwpqgqg77jmxiltx3uhvh5vemkfq4naxy7y7fgrvcm2zlfr6q._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:gg62 rat spyware stealer trojan

Link:

https://tria.ge/reports/230208-rlp9baah4t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Deletes itself

Formbook payload

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/553e1b3e0681bff4b2e85cefba1ea7ed48c5161c682f8fe3e5346a266b2b2c7d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.