Overview

overview

10

Static

static

3

quotation orda.exe

windows7-x64

10

quotation orda.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    quotation orda.exe

  • Size

    685KB

  • Sample

    230504-j63fdach21

  • MD5

    79ac7b7624cbab492eb2444876e0fc7a

  • SHA1

    8f59ff54e030341dd66debe13ccf3a80c630201e

  • SHA256

    08fc30191cdb3900aad985dd7203f002dd7ac1176acd1ae7861021cc641b6a40

  • SHA512

    ae184f1feae78804ffa2eb427b1b744a951cfea63d8005b259f81cabe145e876aab3a78df5c8e583c6916ff920d8a827e10e7254c47b91241c57e777d3a07864

  • SSDEEP

    12288:2qKqnAoLzp6iEZrm4RQMIUa6ijcswvP5IwZ7poXduuW:9n38M4a4Li/0GwuXY

Score
10/10
formbookn13eratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n13e

Decoy

cowiemarketing.com

uniqueliquidz.co.uk

755259.com

7bw95.com

luxbarstools.co.uk

baccaratda.com

berkayakpinar.xyz

gistus.africa

hjd387.com

leave-fly.com

golfclubdaddy.com

engineeringea.buzz

countryrevisited.com

decoracioneskalite.com

imaginationlirbary.com

moneytransfer.africa

brainwaveproject.com

3039sjbqf2022.com

184hotels.com

aromamiaro.com

Targets

    • Target

      quotation orda.exe

    • Size

      685KB

    • MD5

      79ac7b7624cbab492eb2444876e0fc7a

    • SHA1

      8f59ff54e030341dd66debe13ccf3a80c630201e

    • SHA256

      08fc30191cdb3900aad985dd7203f002dd7ac1176acd1ae7861021cc641b6a40

    • SHA512

      ae184f1feae78804ffa2eb427b1b744a951cfea63d8005b259f81cabe145e876aab3a78df5c8e583c6916ff920d8a827e10e7254c47b91241c57e777d3a07864

    • SSDEEP

      12288:2qKqnAoLzp6iEZrm4RQMIUa6ijcswvP5IwZ7poXduuW:9n38M4a4Li/0GwuXY

    Score
    10/10
    formbookn13eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks