Overview

overview

10

Static

static

NEW ORDER.exe

windows7_x64

1

NEW ORDER.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    NEW ORDER.exe
  • Size 695KB
  • Sample220524-p3gmdseefl
  • SHA256 f083cca9a8f0665f33ea6d3a133e5e8fcfc8fc2e4828ddcbd8c035344e7c5667
  • MD5 SHA1 SHA512
Score
10/10
formbookamdfratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • amdf

Decoy

  • xadazheng.com

  • bremorgan.com

  • keilaniclothing.com

  • du9a20ofolvhfr.xyz

  • santamariacourt.com

  • wcagls.com

  • visionuptechnology.com

  • sddysrq.com

  • pencetslot.site

  • wpcoisas.com

  • caomei08.xyz

  • infinitepotential.xyz

  • anotherchanceranch.net

  • ymterp.com

  • zhuyunming.com

  • elementarymodel.com

  • edmondsonfinancial.com

  • adsnethosting.com

  • obohsan-souzokusindan.tech

  • helicopterart.com

Targets

    • Target
      NEW ORDER.exe
    • Size 695KB
    • SHA256 f083cca9a8f0665f33ea6d3a133e5e8fcfc8fc2e4828ddcbd8c035344e7c5667
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookamdfratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks