Overview

overview

10

Static

static

PURCHASE ORDER.exe

windows7-x64

10

PURCHASE ORDER.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PURCHASE ORDER.exe
  • Size 780KB
  • Sample221002-l5mpmsaec9
  • SHA256 91c69e984e53cc30d77e21fcb1a44044fff62368ee2740f04b3b26bfb82f2967
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookuymoratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • uymo

Decoy

  • A4J+j1lFUiMbPgQD0uzpdg==

  • F3lajp/JwxgpzPZ3bf9zrK0EzWDU/JY=

  • bOCwjfx/jOF4Las6GFv7+tQ=

  • 9BDZHgUVSa1ypSWjNcPR

  • S9u+wp+ai+yEW4OWIQ==

  • wXxiP8BRWDG2JiTw5XA=

  • VeumNjNg3QeL/qtw

  • KYxbMI9RU7eqPpEYg1v7+tQ=

  • zwfU2Vv4NxXzDLy1IWFrDo3iqOoV1KB3

  • 0XQ3wM3oGntH+iTw5XA=

  • nx7p2XIfYkHv9+Uu+VKx3l41j3mS454=

  • +BIOmtNni5xbAo5VEZFYQFAw

  • tkQa0SXOEjV/0yTw5XA=

  • YOLHv42Us4eMrHCod80dYluXJzNn

  • HZdsbBNsdAvOq+cr4CaIfg==

  • YlQ/0dwFQYtd+DXIxzKUlO8kBc9C9A==

  • mCL+zS69yZ9DyvVMC4399tE/Xk0V1KB3

  • +tXLkwCl2LyCqaNnalv7+tQ=

  • yPzM2bjLKPyixsjWSoWe9NI=

  • KQPQVL5puBHigv/RmyAU0ExD4GDU/JY=

Targets

    • Target
      PURCHASE ORDER.exe
    • Size 780KB
    • SHA256 91c69e984e53cc30d77e21fcb1a44044fff62368ee2740f04b3b26bfb82f2967
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookuymoratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks