Overview

overview

10

Static

static

Orden de compra.exe

windows7_x64

10

Orden de compra.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Orden de compra.zip

  • Size

    285KB

  • Sample

    210924-pl8pjshae8

  • MD5

    a20c4f9cd84e5896fc10287d62604027

  • SHA1

    545d27b425432ebecabfb82b7a6d6e2f9de73b85

  • SHA256

    9a0390e1d442f3b0c0d3de9552b5a902f0ed5ab4b346d2cb130d182b82d2cd71

  • SHA512

    16bddf2124e2a1533055c4baa9093903a23f99757fd41948071fecc1fd5df50f462c57478031b45fd79962344e89cb024f889cf1d65e72d75a3ea770358a0cc1

Score
10/10
formbook3nopratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

C2

http://www.jakesplacebarbers.com/3nop/

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Targets

    • Target

      Orden de compra.exe

    • Size

      702KB

    • MD5

      ecd71709287a9ff558013bee1575c5bc

    • SHA1

      e81ef75586e2b391ade4cbb62d60aa50cf00c964

    • SHA256

      b6788527f99a436b0e8925eb14c8800ced61fd406edd4182aa00072b3f74f39e

    • SHA512

      3dfddac63d09b61c702d4d7ee615f85a49683b1610eac36625419116381d68f899d652dea942f2d362aae621d9705ec4557827903d0d6d398a056b3754c7019c

    Score
    10/10
    formbook3nopratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks