Overview

overview

10

Static

static

Orden de C...te.exe

windows7-x64

10

Orden de C...te.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28448ce04581e89bad14fbd0e6953244-sample.zip

  • Size

    652KB

  • Sample

    220726-wawzyacael

  • MD5

    9c1008a2817f19a5da648aa70b28a010

  • SHA1

    49a534679658cb6d836e96adbcafe237a15101ee

  • SHA256

    13daa4e080cdda1d0506ad74da6ac34e295684cfe7643a34b91264a1fe70646a

  • SHA512

    e023fa89f564d0b8f521ad88b7e07babdf7b102f922caf522ce677f130812e74b61d47be06bd5b6888a9509007a1464f8c315cf07a98c60fd397c6d373e9ff33

Score
10/10
formbookde08ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

de08

Decoy

retirecloudyyard.com

fabiyan.xyz

chrisarlyde.com

selapex.com

vivalosgales.com

specialty-medicine.com

contasesolucoes.com

satunusanews.net

allyibc.com

alameda1876.com

artofdala.com

yukoidusp.xyz

steeldrumbandnearme.com

stonewedgetechnology.com

kentonai.com

macquarie-private.com

ddgwy.com

megagreenhousekits.com

descomplicaomarketing.com

inclusiverealtor.com

Targets

    • Target

      Orden de Compra Urgente.exe

    • Size

      757KB

    • MD5

      96d65af8738de30dfa2283585f11e1e1

    • SHA1

      fce536c32341baad02ba836a06688ab9f60193b9

    • SHA256

      a69ee77f4eb102a3528594435748d3a1e2925022a6d986eac8d32feb068c1f36

    • SHA512

      99364f2a86bb7a10e57642ad176195df04a746cb2e25d3b2562228f61192634ccec3668b008b141a3fb6864fb6f6608dff3721e96613eb31aaf65e5cb5b204ca

    Score
    10/10
    formbookde08ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks