MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76d60b83c6ed235ce147ff2d704d25e0919db7762b94fae6518521bb3d4b6553. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	76d60b83c6ed235ce147ff2d704d25e0919db7762b94fae6518521bb3d4b6553
SHA3-384 hash:	f197314773d21973cac81b58d60fe6b0586909083224ed0edfef331b5c657a5a6e2b4c17fed92788da56dd35fd53c3dc
SHA1 hash:	d55ee04c8a2166801452aac9c9a2a720138da530
MD5 hash:	052ae328f5bea2df6d3c25ebe38b26c0
humanhash:	london-mirror-jupiter-autumn
File name:	BB7978282629227.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	634'487 bytes
First seen:	2023-06-26 06:59:54 UTC
Last seen:	2023-06-26 07:11:30 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:rQ/ZHincrXfLzlJGROzD+UvR+MGZrEekGh7xM7ZmR7NrzoVFkbGvBeFbf:6icrXfLGMHEMeEqhVbJr87BO
TLSH	T1FCD42375D7678CB1BBD682E5D70DBCA59CBC781A9121006A8C3D0FC73A99117D2A8CE3
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	FormBook rar

cocaman

Malicious email (T1566.001)
From: "Murray Chalibamba <info@lovelywines.co.th>" (likely spoofed)
Received: "from lovelywines.co.th (unknown [185.36.81.72]) "
Date: "24 Jun 2023 03:42:29 +0200"
Subject: "Rooms Inquiry"
Attachment: "BB7978282629227.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	BB7978282629227.exe
File size:	770'048 bytes
SHA256 hash:	10f995960aa806c718494876517cb801027ea00e3110e9b754b1ac039a0f696b
MD5 hash:	bd3151e9631eb98c0084bef3330f235a
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/76d60b83c6ed235ce147ff2d704d25e0919db7762b94fae6518521bb3d4b6553/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

formbook packed

Link:

https://www.filescan.io/uploads/6499377476927ec2c007968a/reports/7dfe5b5f-ca96-4bcd-9d18-328bbe6b1924/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/76d60b83c6ed235ce147ff2d704d25e0919db7762b94fae6518521bb3d4b6553

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/76d60b83c6ed235ce147ff2d704d25e0919db7762b94fae6518521bb3d4b6553/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-06-23 17:36:48 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

20 of 37 (54.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o3laxa6g5urvzykh74wxatjf4ciz3n3wfokpvzsrquq3wpklmvjq._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:he2a rat spyware stealer trojan

Link:

https://tria.ge/reports/230626-mg376ahd43/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Deletes itself

Formbook payload

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/76d60b83c6ed235ce147ff2d704d25e0919db7762b94fae6518521bb3d4b6553

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.