Overview

overview

10

Static

static

1

Order 098383.com.exe

windows7_x64

10

Order 098383.com.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order 098383.com

  • Size

    412KB

  • Sample

    211020-n869kahac9

  • MD5

    55b4851579613a15a12a14948cabce4f

  • SHA1

    f6a02a7c3877eb5fa57aec80d477c4e093ad8b92

  • SHA256

    6b1be3797db71ce042abc0bc3586bb84091084d3a104561a2f0440d8031d35b0

  • SHA512

    fa282a3f3bbf33849075329e2850b58eace6dfebc2b7b3b78fbba5de2359cbd77873e721df94c051c5c3ec1ba2852fcbdb6220fb4e0597b3a9768382e84b3a70

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      Order 098383.com

    • Size

      412KB

    • MD5

      55b4851579613a15a12a14948cabce4f

    • SHA1

      f6a02a7c3877eb5fa57aec80d477c4e093ad8b92

    • SHA256

      6b1be3797db71ce042abc0bc3586bb84091084d3a104561a2f0440d8031d35b0

    • SHA512

      fa282a3f3bbf33849075329e2850b58eace6dfebc2b7b3b78fbba5de2359cbd77873e721df94c051c5c3ec1ba2852fcbdb6220fb4e0597b3a9768382e84b3a70

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks