Overview

overview

10

Static

static

RE,New quo...2].exe

windows7-x64

10

RE,New quo...2].exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RE,New quotations order [13-9-2022].exe

  • Size

    866KB

  • Sample

    220915-1rlyhseba7

  • MD5

    525da79a73552b3ff161e58fa47bdc5f

  • SHA1

    a8d500b4774b1721d95782e58ed9acb434a0ce6e

  • SHA256

    886f9ff18b92cf41d4c0a56e6720304130b15a1656bdc235bd4bf190ef8fd26c

  • SHA512

    41fc1a87cd4138319788734bc149053dfc6fc5c7dd345dcfcac7299c794a0260163846d25e05f1f02e2340e84143f556e2651726f1fc85d0fad605a70e23d56f

  • SSDEEP

    12288:wHx3dMTk7UZJw1T+j4T9iMJC2H/DclhAwePKjzcCSYDa6Fe:cJm4Qc1TiMJC2S+pS8Cvj

Score
10/10
formbookng04ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Targets

    • Target

      RE,New quotations order [13-9-2022].exe

    • Size

      866KB

    • MD5

      525da79a73552b3ff161e58fa47bdc5f

    • SHA1

      a8d500b4774b1721d95782e58ed9acb434a0ce6e

    • SHA256

      886f9ff18b92cf41d4c0a56e6720304130b15a1656bdc235bd4bf190ef8fd26c

    • SHA512

      41fc1a87cd4138319788734bc149053dfc6fc5c7dd345dcfcac7299c794a0260163846d25e05f1f02e2340e84143f556e2651726f1fc85d0fad605a70e23d56f

    • SSDEEP

      12288:wHx3dMTk7UZJw1T+j4T9iMJC2H/DclhAwePKjzcCSYDa6Fe:cJm4Qc1TiMJC2S+pS8Cvj

    Score
    10/10
    formbookng04ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks