General

  • Target

    COMMANDE EN VRAC.rar

  • Size

    231KB

  • Sample

    210929-ytv8vsfgc5

  • MD5

    9e5568652f1ea133267f72338687dca7

  • SHA1

    69202467f9c526cbcbed7da79b0aedce5f864212

  • SHA256

    96b87c129533ba3d6aa099803f4fc2e2bee29c586657d3b0b3b2be677832629e

  • SHA512

    7dd87caba81fb9fdf4c4cacf0369b407d83baf6e210e510f0977d6b53e0eb4b5b444bc61819475e3930136991a0fc1f504176c0ad65ef3c0762df0a077a08555

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      Nouvelle commande 09001.exe

    • Size

      293KB

    • MD5

      5769730bd68a8b558a6932e3b765ad23

    • SHA1

      dac6f67dd39ef8736c750d4e772b2bb2a9d891cb

    • SHA256

      85e45fbdd69f39214a4e3f588d14b1be4a7d81f4503813e1ab834c3525e568a8

    • SHA512

      8ea972a4267a4aff95907547e459912586ec59f648b1858d4b1d29912f5770be9fb59eb898cc703216e5111cdb1a22c239852a9af7746f4dbdc559414fd6f5c4

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Formbook Payload

MITRE ATT&CK Matrix

Tasks