MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 720e92ff7311f11df9d0c37c4728748e82798ddb505422416c803e464743d8e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 720e92ff7311f11df9d0c37c4728748e82798ddb505422416c803e464743d8e5
SHA3-384 hash: 0d342016ecc945e79829e33505d486b9fccbe6b0afb3eafe6bdbe5fe2ad9688b880881192195f16ad0dbb09748c8328c
SHA1 hash: c2b98c5fb330db02bfefbca504c611c6b83c6d14
MD5 hash: 39ef715c3cc013349c99bd5f36bf7202
humanhash: november-alaska-skylark-pasta
File name:New Order.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:270'247 bytes
First seen:2023-02-13 07:48:59 UTC
Last seen:2023-02-13 08:13:34 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:pStkjpAiAEJsiN2kzJswzHXhWY9Nv35jVKRRvs5G/UY:0tkjpAW31zJLsY35pK/05G/D
TLSH T1D44423A0889F81F2A2868D257920AE5D805FB874357B776B44C211D286DF87CBD47CE9
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:FormBook RFQ zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Chris"<sales3@gfuve.com>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.136]) "
Date: "11 Feb 2023 10:56:15 +0100"
Subject: "RE.RFQ: New Order 6189"
Attachment: "New Order.zip"

Intelligence

File Origin
# of uploads :
6
# of downloads :
93
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:New Order.exe
File size:285'046 bytes
SHA256 hash: 8aa4a5feee91f2caa993c9624153ee2ecbe97098fc7470a5103c408376b2a12a
MD5 hash: 99ac27ed7ab8bccf12782f4ffc8a3882
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs3151.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20230211-0434.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20634.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/720e92ff7311f11df9d0c37c4728748e82798ddb505422416c803e464743d8e5
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/720e92ff7311f11df9d0c37c4728748e82798ddb505422416c803e464743d8e5
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/720e92ff7311f11df9d0c37c4728748e82798ddb505422416c803e464743d8e5/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-02-11 08:47:12 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
24 of 39 (61.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oihjf73tchyr36oqyn6eokdur2bhtdo3kbkceqlmqa7emr2d3dsq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230213-l3ydcsce26/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/720e92ff7311f11df9d0c37c4728748e82798ddb505422416c803e464743d8e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 720e92ff7311f11df9d0c37c4728748e82798ddb505422416c803e464743d8e5

(this sample)

Formbook

Executable exe 8aa4a5feee91f2caa993c9624153ee2ecbe97098fc7470a5103c408376b2a12a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8aa4a5feee91f2caa993c9624153ee2ecbe97098fc7470a5103c408376b2a12a
  
Dropping
Formbook

Comments