Overview

overview

10

Static

static

NEW ORDER_pdf.exe

windows7_x64

10

NEW ORDER_pdf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEW ORDER_pdf.exe

  • Size

    602KB

  • Sample

    210114-q79rc5hsxn

  • MD5

    dc743359268cefe59904fa804112f012

  • SHA1

    fcc10908413f0122fec5b19e15135957678c70d3

  • SHA256

    3df48002a1199ab680bea952851cdc0a93f905f21d09245889d6332af639fe68

  • SHA512

    8608789bd57073f65675ff160522fb29f771c6242d508ab0ca391ba22310ff030a1f40bcce5c79c1985c8ca05c3bb3528f488f6246d6d160dd4d152dad2b9752

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.freshpixels.agency/wls/

Decoy

brandcamapp.com

hotels-online.net

godsbaconjitters.com

renpaulhotpot.com

bikescarznguitarz.com

amelclothing.com

zhuqiuhui.space

theolivetreeonline.com

yizddmall.com

junkshoptheatre.com

smithylabs.com

cocokaraget.com

rayscollectibles.com

encinolandscapedesign.com

trzeks1.com

jstracker.net

cloudadventure.zone

emilyshines.com

exiledfg.com

seasisterscoastal.com

Targets

    • Target

      NEW ORDER_pdf.exe

    • Size

      602KB

    • MD5

      dc743359268cefe59904fa804112f012

    • SHA1

      fcc10908413f0122fec5b19e15135957678c70d3

    • SHA256

      3df48002a1199ab680bea952851cdc0a93f905f21d09245889d6332af639fe68

    • SHA512

      8608789bd57073f65675ff160522fb29f771c6242d508ab0ca391ba22310ff030a1f40bcce5c79c1985c8ca05c3bb3528f488f6246d6d160dd4d152dad2b9752

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks