Overview

overview

10

Static

static

Purchase O...27.exe

windows7_x64

10

Purchase O...27.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order-070POR044127.exe

  • Size

    755KB

  • Sample

    210505-pl1elz6b4a

  • MD5

    86ac789b8bc139ec5dbc204e7a3dd589

  • SHA1

    eadec8bb5cf57113589f456e4d237ae9610e242c

  • SHA256

    e8baf97ad51faed006287d1f01f921df0f677d4f056d35697158d30aa24ace9b

  • SHA512

    fca533d07a06337cb61bfe84cde9e7b1eb240e6a7d7f4ca001a232916c79465c6c908be5040c83e0218ac679f651e2a7209f7672ee08e41dcd413c9772e4c2d3

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.magnumopuspro.com/nyr/

Decoy

anemone-vintage.com

ironcitytools.com

joshandmatthew.com

breathtakingscenery.photos

karabakh-terror.com

micahelgall.com

entretiendesterrasses.com

mhgholdings.com

blewm.com

sidewalknotary.com

ytrs-elec.com

danhpham.com

ma21cle2henz.xyz

lotusforlease.com

shipleyphotoandfilm.com

bulktool.xyz

ouedzmala.com

yichengvpr.com

connectmygames.com

chjcsc.com

Targets

    • Target

      Purchase Order-070POR044127.exe

    • Size

      755KB

    • MD5

      86ac789b8bc139ec5dbc204e7a3dd589

    • SHA1

      eadec8bb5cf57113589f456e4d237ae9610e242c

    • SHA256

      e8baf97ad51faed006287d1f01f921df0f677d4f056d35697158d30aa24ace9b

    • SHA512

      fca533d07a06337cb61bfe84cde9e7b1eb240e6a7d7f4ca001a232916c79465c6c908be5040c83e0218ac679f651e2a7209f7672ee08e41dcd413c9772e4c2d3

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks