Overview

overview

10

Static

static

Purchase I...df.exe

windows7_x64

10

Purchase I...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Inquiry.Pdf.exe

  • Size

    1.2MB

  • Sample

    210728-1z6gwz85j6

  • MD5

    d6a51d185e394a8e26bd1a29406d283a

  • SHA1

    26128b0684a819e3488158d040c4d1b906ff473d

  • SHA256

    0cc7962edb5360efdaefae56eeee07f8c70aa2107663f92442df041509e82e93

  • SHA512

    3150c5cc23ca3b4b8ce3bbf9bf7097029e3cb3e5eebef590ca942c1c9424a178b890c39191815149752ef84c06ef2c98576590b2a7404e3d767feb5138d19ac8

Score
10/10
formbookratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.papablogzzi.com/obow/

Decoy

hinetin.net

narrativebusters.com

jesusmusicatl.com

mywellnessbooking.com

830272.com

mainrein.com

kajeoneworld.com

directaccesss.com

igsecretos.com

campbone.com

socialvidiots.com

abditrade.com

purisopropyl.com

opticalapparatus.com

staveoffboredom.com

evinja.com

onlinebusinesstoolselector.com

todayonly2.info

elitedesign-dz.com

zgszgw.com

Targets

    • Target

      Purchase Inquiry.Pdf.exe

    • Size

      1.2MB

    • MD5

      d6a51d185e394a8e26bd1a29406d283a

    • SHA1

      26128b0684a819e3488158d040c4d1b906ff473d

    • SHA256

      0cc7962edb5360efdaefae56eeee07f8c70aa2107663f92442df041509e82e93

    • SHA512

      3150c5cc23ca3b4b8ce3bbf9bf7097029e3cb3e5eebef590ca942c1c9424a178b890c39191815149752ef84c06ef2c98576590b2a7404e3d767feb5138d19ac8

    Score
    10/10
    formbookratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks