Overview

overview

10

Static

static

Ref8810998...rm.exe

windows7-x64

10

Ref8810998...rm.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Ref8810998235 Auto Generated Order Form.exe
  • Size 937KB
  • Sample221007-lh65rsccdl
  • SHA256 3d9766bbf57730b0aa1d3d43a8ce30d7f7b0798b82f32d235a06af5cdbb6ab6c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookr83rratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • r83r

Decoy

  • dF1arqf0q8jqGHpo

  • 3s5obdLT/D42OkXYzXA=

  • MY4GqPg1TNBZiXEkrsyhlycGUN24oOaU

  • wKsmWEGSmhvRwo4=

  • jXeqRbgNrXzVBjEkt+Ircn8q8uqLRxB04g==

  • kWzwCGp3hZyQemHg2Ho=

  • vlaarHzH3YTtXSLeyQ==

  • LSNL62SxS36qDZBx

  • QzB7kGyuEkIf

  • AFmNF5DlgUzZjArFIxovHKlaz9E74po=

  • C/cWvSksOW1y2Gdi

  • 5FdJf9GEwRvRwo4=

  • szFiiGFq8ubjqCPe/ChZC0g=

  • AWObGX3KVG9bBtWG4Mu5

  • 80uIK32XLmNVA4xryvpajNA0

  • 10WHLY+Nqu3Pkw/cKRD3Y6pVG8jd

  • kW/9OTF2FgXkki8UJM8K1vSogA0XnQ==

  • mAtF/lLM2RvRwo4=

  • VNFX6OUCoH1rU0XYzXA=

  • qAdGBejjez+ZCfPo0A==

Targets

    • Target
      Ref8810998235 Auto Generated Order Form.exe
    • Size 937KB
    • SHA256 3d9766bbf57730b0aa1d3d43a8ce30d7f7b0798b82f32d235a06af5cdbb6ab6c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookr83rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks