General
- Target PAGO FACTURA-GABAR ELECTRICA-password(GthBqaJV).zip
- Size 1.6MB
- Sample260722-vcdqpshf45
- SHA256 6fd48dc1d3d10720d12a8be2617e0f11a58c6df14088e535c32fb26718617d98
Malware Config
Targets
-
- Target a1982335-e1d7-4c8e-90ef-12030751872d.eml
- Size 1.6MB
- SHA256 6c60f746f3923d396b91a4f16e5f93f0839b95ff2811ccb078ecb65ad16abc6b
Score6/10Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Pago Ofix Gabar $5,217.70.tar
- Size 1.2MB
- SHA256 b79c727f89493db2a49f96e02a19bb20e4cc35eea630472455c013fc1cb604d8
Score10/10Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
Formbook payload
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Accesses Microsoft Outlook profiles
Drops desktop.ini file(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
-
- Target Pago Ofix Gabar $5,217.70.vbs
- Size 1.2MB
- SHA256 14635bbca8f3850c1b1287abd3908e513033580e727e73aa2e51874d5a426f75
Score10/10Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Executes a VBScript file via the Windows Script Host.