Overview

overview

10

Static

static

orden de c...df.exe

windows7_x64

10

orden de c...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    orden de compra pdf.exe

  • Size

    758KB

  • Sample

    220211-r75wwscge5

  • MD5

    89f889b05115d5e7e9f84f059d967d45

  • SHA1

    241cbc0d823d4b74a95b09ae5a3719b39abc279e

  • SHA256

    2c3c06ae684b68083640169fb962cc24fb32d4efe232a0ec0727f7c5d69dacae

  • SHA512

    110042d4c670680c4f5ccc422c540d9b5a12895e671e5cab98b96d5c7ac6c7d055a51cf5775c6fb2357b172d1efe5c4cf0849ea631d8654f1fb5fb8c406e5fdd

Score
10/10
formbookg2m3ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2m3

Decoy

stocktonfingerprinting.com

metaaiqr.com

junicy.com

libertymutualgrou.com

jklhs7gl.xyz

alex-covalcova.space

socialfiguild.com

drnicholasreid.com

androidappprogrammierie.com

relatingtohumans.com

jitsystems.com

gbwpmz.com

lesaventuresdecocomango.com

wu8ggqdv077p.xyz

autnvg.com

wghakt016.xyz

lagosian.store

hilldoor.com

oculos-ajustavel-br.xyz

nameniboothac.com

Targets

    • Target

      orden de compra pdf.exe

    • Size

      758KB

    • MD5

      89f889b05115d5e7e9f84f059d967d45

    • SHA1

      241cbc0d823d4b74a95b09ae5a3719b39abc279e

    • SHA256

      2c3c06ae684b68083640169fb962cc24fb32d4efe232a0ec0727f7c5d69dacae

    • SHA512

      110042d4c670680c4f5ccc422c540d9b5a12895e671e5cab98b96d5c7ac6c7d055a51cf5775c6fb2357b172d1efe5c4cf0849ea631d8654f1fb5fb8c406e5fdd

    Score
    10/10
    formbookg2m3ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks