Overview

overview

10

Static

static

1

Nouvel ordre.exe

windows7_x64

10

Nouvel ordre.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nouvel ordre.exe

  • Size

    259KB

  • Sample

    211004-mqjvwagbe7

  • MD5

    ba2cd86b94baeb58becd532319250fe2

  • SHA1

    31e88e27c5840c2a0b7840d3c4c0acd489f0a8e5

  • SHA256

    6d725aa4c3dd38bc7f924af4891b82a9c993e2db67765c72be42778a9c1b561a

  • SHA512

    7c3b2b3c3446bd2c1ea04c2d84cfed87ee5b686af62702a06199619e2a96fba300b7ac91a1f14699e38d53ae342d16b38436bc9b2c54bc8967366d6031fc549b

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      Nouvel ordre.exe

    • Size

      259KB

    • MD5

      ba2cd86b94baeb58becd532319250fe2

    • SHA1

      31e88e27c5840c2a0b7840d3c4c0acd489f0a8e5

    • SHA256

      6d725aa4c3dd38bc7f924af4891b82a9c993e2db67765c72be42778a9c1b561a

    • SHA512

      7c3b2b3c3446bd2c1ea04c2d84cfed87ee5b686af62702a06199619e2a96fba300b7ac91a1f14699e38d53ae342d16b38436bc9b2c54bc8967366d6031fc549b

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks