Overview

overview

10

Static

static

new order..xlsx

windows7_x64

10

new order..xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    new order..xlsx

  • Size

    824KB

  • Sample

    211124-pep9mafgd3

  • MD5

    13207cd20233a5ce5b2c4a27513d9a06

  • SHA1

    43a79651932f17a6fcd2939c778f2ec2453004f4

  • SHA256

    7fe64335c809c9215feae77093350074fa753aea2439d3d8a5e30c951da11eea

  • SHA512

    f6db4b61137df01cdb5b4604f680557bc793842b11c334a2c23f8fd20549c85d5573cdcb7cebd596caec1d846181cf81edfa0b4775d4827df4b7aeafaed0883e

Score
10/10
formbookjy0bratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy0b

C2

http://www.filecrev.com/jy0b/

Decoy

lamejorimagen.com

mykabukibrush.com

modgon.com

barefoottherapeutics.com

shimpeg.net

trade-sniper.com

chiangkhancityhotel.com

joblessmoni.club

stespritsubways.com

chico-group.com

nni8.xyz

searchtypically.online

jobsyork.com

bestsales-crypto.com

iqmarketing.info

bullcityphotobooths.com

fwssc.icu

1oc87s.icu

usdiesel.xyz

secrets2optimumnutrition.com

Targets

    • Target

      new order..xlsx

    • Size

      824KB

    • MD5

      13207cd20233a5ce5b2c4a27513d9a06

    • SHA1

      43a79651932f17a6fcd2939c778f2ec2453004f4

    • SHA256

      7fe64335c809c9215feae77093350074fa753aea2439d3d8a5e30c951da11eea

    • SHA512

      f6db4b61137df01cdb5b4604f680557bc793842b11c334a2c23f8fd20549c85d5573cdcb7cebd596caec1d846181cf81edfa0b4775d4827df4b7aeafaed0883e

    Score
    10/10
    formbookjy0bratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks