MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7
SHA3-384 hash: c491ec63e943fc07a3095bc1f4d964e0cc000687d391bfe6093f64fa2b0b74c06baf25cd6bbed8ad443de43061e16f10
SHA1 hash: 9cfb01a7f1fa2439f50ae28865741d10859042e3
MD5 hash: 14797c70f8e6515d5412b6d19f04851b
humanhash: romeo-lake-east-harry
File name:OUR REF RFQ 600066536 - PR 10023150.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:671'744 bytes
First seen:2023-06-09 13:16:09 UTC
Last seen:2023-06-09 13:57:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:PrGnmUAhgkCBU8kqiKpwPluNJJxT957M2VrRw61QwdF5CnKIBeVViEvKhX1F2FWj:o3vbC8QXKdiEvKhFFaW9x
Threatray 2'355 similar samples on MalwareBazaar
TLSH T1D4E4013FBAECFD6BC66C4DF800A09826DBF57A561492E3C85CC6B5CB42D9BE05600197
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter cocaman
Tags:exe FormBook RFQ

Intelligence

File Origin
# of uploads :
2
# of downloads :
283
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
OUR REF RFQ 600066536 - PR 10023150.exe
Verdict:
No threats detected
Analysis date:
2023-06-09 13:17:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c071836d-f3d9-4d75-9894-73bb269b98e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/397399/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.17152.15571.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/6483264f3d73a4d71709de77/reports/17cd252b-a461-43d6-843d-e137a8967b30/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/efd67b0a-ccb2-4316-9b8f-3fe13b55d3de
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1251950
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-09 00:51:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
19 of 35 (54.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mb643a3l2m5g2kx6n3z4mmsgr3ysn22jsi2atysgxj7mqyyrywtq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0003b5d6c92e1466b6f734da9175b9cfc65ebd4d576b73f92100b0b2e899bb3b
Formbook
1d362a46e002c187e1ad022dea2fa97809a211c9ba763cfe63600d893fa3ab08
Formbook
36bd2802a452a2bee1659648b0a4b1de0cde1ebac09d0d5ebe0e2c1189483432
Formbook
4759019b080ba0e6212bf1db94be7c1efebcb517a7cd7060186f50731c662769
Formbook
6371e6f808e46f98c8d2e98d1a81203dc6ec3aa755ee5e61bee436bcfdb92cbd
Formbook
6e47d662e6f00f4c8b160545fc27354f3e2fb8955aa1c4de6303f44a80b6015c
Formbook
83655561bbc25a8d8d3e737bed283be32e228982310731a9640000797cd520b3
Formbook
8bc2209887fffd6b27980ba8c2c138deb45370c5b0a8434f9542897c6a05c931
Formbook
a29611641a2f20fafa07843982a24baf1e253bf03439d0905b61e816339158f9
Formbook
e2c2908685e1e75ab146191d8757a42fda84c0c0be27f2fd7fe301a8fc0bb679
Formbook
+ 2'345 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230609-qjcprscb74/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
e031d5f3652259dd052e79eaee198ab7fb0feb522a859771289a39a73a297f06
MD5 hash:
5e5b621044793588fde2b9482b862083
SHA1 hash:
b85e8343fc412a63748589cd544b90ccc841dc92
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/f0a2a3a9-53ff-42c1-8a14-bd63864ad3a0/
Parent samples :
0003b5d6c92e1466b6f734da9175b9cfc65ebd4d576b73f92100b0b2e899bb3b
19a7140e84227b4d9af59569af23a0a5a1edd34c45b24691348f227f2c540712
4759019b080ba0e6212bf1db94be7c1efebcb517a7cd7060186f50731c662769
a4d87571d194ad479fd34b94ea91c8afb5b0bd448f2032a8868fa5c16adbaa73
e2c2908685e1e75ab146191d8757a42fda84c0c0be27f2fd7fe301a8fc0bb679
1d362a46e002c187e1ad022dea2fa97809a211c9ba763cfe63600d893fa3ab08
83655561bbc25a8d8d3e737bed283be32e228982310731a9640000797cd520b3
8bc2209887fffd6b27980ba8c2c138deb45370c5b0a8434f9542897c6a05c931
ede3876cdaa9f15dc9f49a080713bfc4e254d222d99c2a09b999d62d1d4f8c05
b755e080b9f6705b088275a44a96251bc547ad58b4f63c9988d90e1c97bf283f
36bd2802a452a2bee1659648b0a4b1de0cde1ebac09d0d5ebe0e2c1189483432
6371e6f808e46f98c8d2e98d1a81203dc6ec3aa755ee5e61bee436bcfdb92cbd
a29611641a2f20fafa07843982a24baf1e253bf03439d0905b61e816339158f9
607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7
00446b78e85b721ff8ab19643f451074ed52d3ceb924f059f1b1c778af8fc42f
SH256 hash:
fc83e07cff47a7ea1058bf4d75f6d98fcdaf457a6f88007dccbbc36796a16847
MD5 hash:
fe559bbf47ec0c554420bba97f79ba0e
SHA1 hash:
c097427b5800a352d105c830e98332fe8925bcdc
Link:
https://www.unpac.me/results/f0a2a3a9-53ff-42c1-8a14-bd63864ad3a0/
SH256 hash:
2c86fbd27864054476a9dc8072027928382a76605b7ad6257f06edd3aa850c69
MD5 hash:
86500311a74f6d0b2b3facebd93f9c17
SHA1 hash:
d6fa9a86532e8f85b9eda7a644ef3053b593db70
Link:
https://www.unpac.me/results/f0a2a3a9-53ff-42c1-8a14-bd63864ad3a0/
SH256 hash:
0a91725affc12422a6e5ee2bec1cc602bbfcf2f42001de937e341540ef041066
MD5 hash:
c6a9fe93b15c4bd0f259fb139cb9f2e9
SHA1 hash:
91a883deaa021ee2f3b1344905320646ffec272b
Link:
https://www.unpac.me/results/f0a2a3a9-53ff-42c1-8a14-bd63864ad3a0/
SH256 hash:
3f1bb439dc1e39bdc7ea992cdbacc9583d53e6c4949433f94a8e5be5fa4d3d29
MD5 hash:
be030d800cea4838ad5a4a7559ed3c32
SHA1 hash:
81a03d90b451475d7b229ae91a811800e03f6cb2
Link:
https://www.unpac.me/results/f0a2a3a9-53ff-42c1-8a14-bd63864ad3a0/
SH256 hash:
059763c48a01498ee6908ff1b2933880f39fb464c65befe2cd624ded95fcae36
MD5 hash:
e9913d15f59c000ec4bd501c0dd85438
SHA1 hash:
6db32c1c224edd1be64e66f2ad97258ba45a0bd9
Link:
https://www.unpac.me/results/f0a2a3a9-53ff-42c1-8a14-bd63864ad3a0/
SH256 hash:
607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7
MD5 hash:
14797c70f8e6515d5412b6d19f04851b
SHA1 hash:
9cfb01a7f1fa2439f50ae28865741d10859042e3
Link:
https://www.unpac.me/results/f0a2a3a9-53ff-42c1-8a14-bd63864ad3a0/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/607dcd836bd3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a90041c572a519d2de1a6ccfc5e527a5cd5935b58f362fe6eb0715c4354a9b8d

Formbook

Executable exe 607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 a90041c572a519d2de1a6ccfc5e527a5cd5935b58f362fe6eb0715c4354a9b8d
Cape
Cape
https://www.capesandbox.com/analysis/397399/
  
Dropped by
MD5 92a3eb7b0e4b72d2a281e5f48be97784

Comments