General
- Target 27062026_1732_26062026_Ad_MV_INO_HORIZON_NEW_SPARE_PARTS_DETAIL_pdf.rar
- Size 2.0MB
- Sample260627-yabecac15s
- SHA256 af0577103fdfb95c47376adb13417130d7a7fe1c146baa745fbb522671d72bf1
Score
10/10
Malware Config
Targets
-
- Target Ad_MV_INO_HORIZON_NEW_SPARE_PARTS_DETAIL_pdf.exe
- Size 3.9MB
- SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of SetThreadContext
-
- Target Secur32.dll
- Size 1.8MB
- SHA256 1bfc8230e6e1ae0e4f3eb00d46d1f2ff3806e66cce2400978a08e484ac20c220
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1