Overview

overview

10

Static

static

5

Purchase Order.exe

windows7-x64

10

Purchase Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order.exe

  • Size

    1.1MB

  • Sample

    241024-sp8eqswcrj

  • MD5

    94daadddb5b3e3956f73406790c783d4

  • SHA1

    5da5fc49b2274bdf8473fb20ccde40c03efce1ad

  • SHA256

    4db726b9acaf73c52d7841dd9b3463df1d0f6eb5e3148a69ef9c13efcf6c8982

  • SHA512

    288094e9379fdcd1d3b62d1a4311633a45f72d864da7ec9bee27809c74c9695e8f5b3217a9852c226a56c567f8eaa095960c8bc696b6f2d1530bcc3125a98f17

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLuxFWW9r/8+gwt1vfwLt7M:f3v+7/5QLiWWtk+za7M

Score
10/10
formbookge07discoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge07

Decoy

amyard.shop

eloshost.xyz

g18q11a.top

orensic-vendor-735524320.click

ithin-ksvodn.xyz

xhyx.top

elonix-traceglow.pro

cillascrewedsedroth.cfd

wner-nyquh.xyz

reyhazeusa.shop

esmellretaperetotal.cfd

hqm-during.xyz

pipagtxcorrelo.xyz

lray-civil.xyz

apybarameme.xyz

rbuds.shop

hild-fcudh.xyz

rkgexg.top

estwestcottwines.shop

giyztm.xyz

Targets

    • Target

      Purchase Order.exe

    • Size

      1.1MB

    • MD5

      94daadddb5b3e3956f73406790c783d4

    • SHA1

      5da5fc49b2274bdf8473fb20ccde40c03efce1ad

    • SHA256

      4db726b9acaf73c52d7841dd9b3463df1d0f6eb5e3148a69ef9c13efcf6c8982

    • SHA512

      288094e9379fdcd1d3b62d1a4311633a45f72d864da7ec9bee27809c74c9695e8f5b3217a9852c226a56c567f8eaa095960c8bc696b6f2d1530bcc3125a98f17

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLuxFWW9r/8+gwt1vfwLt7M:f3v+7/5QLiWWtk+za7M

    Score
    10/10
    formbookge07discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks