Overview

overview

10

Static

static

3

NEW PURCHA...85.exe

windows10-1703-x64

10

NEW PURCHA...85.exe

windows7-x64

10

NEW PURCHA...85.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEW PURCHASE ORDER MAY 00957585.exe

  • Size

    704KB

  • Sample

    230511-qsgp3sfc8v

  • MD5

    811027b8823ce068fa572fd1e782b126

  • SHA1

    0ea06503dd9e0bb2946b2b600746a22a9c489bfc

  • SHA256

    90315c352a9820703d29e4dcd9360660dd23bbfac585030993404076b998e45c

  • SHA512

    6cae36f495db62bc8b337797e00a2288f3bab8bd1ae5a71c48f972a653090e641eb015ef891c03325013d19af8ccbc50ef47aea1923d1afc0207cb17c9f86d01

  • SSDEEP

    12288:fvmbfOJWMnslt0uWDGRQjKyZnutU3UODbOJ0xHSTm/K4dHmNhdm:XmbfOnsltPWyRQjhZutGnGywTmS4s

Score
10/10
formbookgtt8ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      NEW PURCHASE ORDER MAY 00957585.exe

    • Size

      704KB

    • MD5

      811027b8823ce068fa572fd1e782b126

    • SHA1

      0ea06503dd9e0bb2946b2b600746a22a9c489bfc

    • SHA256

      90315c352a9820703d29e4dcd9360660dd23bbfac585030993404076b998e45c

    • SHA512

      6cae36f495db62bc8b337797e00a2288f3bab8bd1ae5a71c48f972a653090e641eb015ef891c03325013d19af8ccbc50ef47aea1923d1afc0207cb17c9f86d01

    • SSDEEP

      12288:fvmbfOJWMnslt0uWDGRQjKyZnutU3UODbOJ0xHSTm/K4dHmNhdm:XmbfOnsltPWyRQjhZutGnGywTmS4s

    Score
    10/10
    formbookgtt8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks