Overview

overview

10

Static

static

Pedido 299.exe

windows7_x64

10

Pedido 299.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Borrador de pedido.rar
  • Size 281KB
  • Sample210930-eyaceagdc9
  • SHA256 1cf584b3c3eededb83018e351db64db867ed30dc15fb280d14c2d7ef810db423
  • MD5 SHA1 SHA512
Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • dn7r

C2

  • http://www.yourherogarden.net/dn7r/

Decoy

  • eventphotographerdfw.com

  • thehalalcoinstaking.com

  • philipfaziofineart.com

  • intercoh.com

  • gaiaseyephotography.com

  • chatbotforrealestate.com

  • lovelancemg.com

  • marlieskasberger.com

  • elcongoenespanol.info

  • lepirecredit.com

  • distribution-concept.com

  • e99game.com

  • exit11festival.com

  • twodollartoothbrushclub.com

  • cocktailsandlawn.com

  • performimprove.network

  • 24horas-telefono-11840.com

  • cosmossify.com

  • kellenleote.com

  • perovskite.energy

Targets

    • Target
      Pedido 299.exe
    • Size 382KB
    • SHA256 28f0397af278256b634686ba73bd16ab3344f29e3a4ed7fe486e2408ee52345a
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Formbook Payload

      rat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks