Overview

overview

10

Static

static

1

Order Inquiry.exe

windows7_x64

10

Order Inquiry.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order Inquiry.exe

  • Size

    222KB

  • Sample

    210408-zrdtzkhyg6

  • MD5

    6664568334aabc380dda1821fdd379d9

  • SHA1

    8b847d59b54068e0cb5316c1e4f6e5db286d98d9

  • SHA256

    ee0a32169adde722c5652fb40046d8251fa8a89ce615a637ed5708372af0d163

  • SHA512

    cb391712b7c9138cb12bc5f0176ddb7739f25db7e1c4da03b02ba0b68ba0cce00650341230f189fff1f398eab7ac0ac2584d4d171a5f6430c78130dbd6e431fa

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.c-voyageinc.com/r4ei/

Decoy

8clintonstreet.com

sherylhotpepperblends.com

eucham.asia

earnestqueen.com

vstexchange.com

theoutofbounds.com

allincursive.com

getgenevieved.com

commonlawpeoplesassembly.net

brideclubstorerastreamento.com

cngelectricaldesign.com

mizmaleather.com

nicolabenge.com

babyboxbuy.com

xaydungquan9.com

hclifechurch.com

cwyxonlp.icu

inocentkidd.com

worldhw.com

soul.exchange

Targets

    • Target

      Order Inquiry.exe

    • Size

      222KB

    • MD5

      6664568334aabc380dda1821fdd379d9

    • SHA1

      8b847d59b54068e0cb5316c1e4f6e5db286d98d9

    • SHA256

      ee0a32169adde722c5652fb40046d8251fa8a89ce615a637ed5708372af0d163

    • SHA512

      cb391712b7c9138cb12bc5f0176ddb7739f25db7e1c4da03b02ba0b68ba0cce00650341230f189fff1f398eab7ac0ac2584d4d171a5f6430c78130dbd6e431fa

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks