Overview

overview

10

Static

static

1

NEW ORDER.exe

windows7_x64

10

NEW ORDER.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEW ORDER.gz

  • Size

    216KB

  • Sample

    210507-9ca1qfhzhs

  • MD5

    5600d52b0e2fe64de58ae7ac548ea908

  • SHA1

    a5b98d75bee2bbf35439f9b4bb6eb7da2ee9a447

  • SHA256

    22eedf157489cb801900f963c3dd77fc047064b17965e06f7582f98cd6ad7753

  • SHA512

    8a1229cb0c48d00538ec251ed40f8b7b42d6273a1983507f9ac0a6e2dea7e68becdac3a38965b718be868dc055e2d3720620b4f4c60552da5bbd95fce1f794b8

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.knighttechinca.com/dxe/

Decoy

sardarfarm.com

959tremont.com

privat-livecam.net

ansel-homebakery.com

joysupermarket.com

peninsulamatchmakers.net

northsytyle.com

radioconexaoubermusic.com

relocatingrealtor.com

desyrnan.com

onlinehoortoestel.online

enpointe.online

rvvikings.com

paulpoirier.com

shitarpa.net

kerneis.net

rokitreach.com

essentiallygaia.com

prestiged.net

fuerzaagavera.com

Targets

    • Target

      NEW ORDER.exe

    • Size

      277KB

    • MD5

      fdb13566001939b797325265bc1048e0

    • SHA1

      096a63354f73bcc105030ede2f04c5bb12cf2711

    • SHA256

      3f2cdc7783014a37d7ad61ee00c226d5221d4932f4113eb3590a9c9d0447b461

    • SHA512

      faac103a3a220885b3e4ec848e384e9b8b7ce9a19ab90c97d6319106e0a00275b0d6a51ab94e63bad147e2bcb32cc8ef051705c3b5e019ae1374cfdb901bf934

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks