Overview

overview

10

Static

static

New-Order1722.exe

windows7-x64

10

New-Order1722.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    New-Order1722.exe
  • Size 660KB
  • Sample221117-vgtygsfa55
  • SHA256 7a16dce8bd82a023e48ceed80a37c70de9859cba4764686bf41b2b14df81ce3a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookkeb5ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • keb5

Decoy

  • franktrichards.mobi

  • teahxy.com

  • topmallset.com

  • gajah77.info

  • sweetncliffjr.com

  • alliancegh.com

  • cue-track.com

  • lifecreditsystem.com

  • disegno-creativo.com

  • pelabuhanratu.com

  • cristidesign.com

  • heimeier-executive.com

  • cliphitech.net

  • n1663.com

  • applehelpp.store

  • rachelmurphygardens.com

  • angelstylesy.com

  • qhfkw.club

  • onesportsnetwork.com

  • thesuperiorbaths.com

Targets

    • Target
      New-Order1722.exe
    • Size 660KB
    • SHA256 7a16dce8bd82a023e48ceed80a37c70de9859cba4764686bf41b2b14df81ce3a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookkeb5ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks