General
- Target rconfirma____odepagamento_PDF.exe
- Size 987KB
- Sample260720-x6vx7aex4x
- SHA256 b393bd767c142e171dd1b2928bae16fff2f63b3d319b2c1acb37129d8d538cc9
Score
10/10
Malware Config
Targets
-
- Target rconfirma____odepagamento_PDF.exe
- Size 987KB
- SHA256 b393bd767c142e171dd1b2928bae16fff2f63b3d319b2c1acb37129d8d538cc9
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1