Overview

overview

10

Static

static

1

NUEVA ORDE...RA.exe

windows7-x64

10

NUEVA ORDE...RA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NUEVA ORDEN DE COMPRA.exe

  • Size

    796KB

  • Sample

    230206-t2j4caab3z

  • MD5

    066ce326ce4a330b8d5205450e7db45a

  • SHA1

    6e09f8b98e2502ab285db9430717bc062fdf07ac

  • SHA256

    6b5b7952bdd33c6b92105d81a2211e7a2f907b89fd0a76c344db8ded9dc36802

  • SHA512

    d5e2627f5f9756cecd3901eb77903165517bbbbcf17731cfa938bff82ed04fb796eb7f0a1ea599274731241058b498921be450e75b235402f98e7be6623f66c1

  • SSDEEP

    12288:Hpk8PAMcXnyXx6q1DzK389803EmEoPpnNH6VAgNEJEvbqgll84UX208VfCHJZahs:bAM1NooCGnhHWvBoX208VqpZS5G

Score
10/10
formbookcy01ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cy01

Decoy

beauty-clean.site

funsellers.shop

digichatbox.com

greenleafpestsvcs.com

getcashs.shop

jessbenitez.net

bridgeworksmotcentre.co.uk

chorusmobile.africa

kiralayolla.com

ft-vip.club

fromlearnerstoimpacters.com

baldwinaesthetics.com

legacyfinehomescb.com

adnaturaltours.com

hzdingyushangwu.com

brinkworthchurch.co.uk

statesurvival.net

beingabroad.store

gmkmc.com

toubra.africa

Targets

    • Target

      NUEVA ORDEN DE COMPRA.exe

    • Size

      796KB

    • MD5

      066ce326ce4a330b8d5205450e7db45a

    • SHA1

      6e09f8b98e2502ab285db9430717bc062fdf07ac

    • SHA256

      6b5b7952bdd33c6b92105d81a2211e7a2f907b89fd0a76c344db8ded9dc36802

    • SHA512

      d5e2627f5f9756cecd3901eb77903165517bbbbcf17731cfa938bff82ed04fb796eb7f0a1ea599274731241058b498921be450e75b235402f98e7be6623f66c1

    • SSDEEP

      12288:Hpk8PAMcXnyXx6q1DzK389803EmEoPpnNH6VAgNEJEvbqgll84UX208VfCHJZahs:bAM1NooCGnhHWvBoX208VqpZS5G

    Score
    10/10
    formbookcy01ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks