General
- Target PAGO FACTURA-GABAR ELECTRICA-password(GthBqaJV).zip
- Size 1.6MB
- Sample260722-vcdqpshf45
- SHA256 6fd48dc1d3d10720d12a8be2617e0f11a58c6df14088e535c32fb26718617d98
Malware Config
Targets
-
- Target a1982335-e1d7-4c8e-90ef-12030751872d.eml
- Size 1.6MB
- SHA256 6c60f746f3923d396b91a4f16e5f93f0839b95ff2811ccb078ecb65ad16abc6b
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Pago Ofix Gabar $5,217.70.tar
- Size 1.2MB
- SHA256 b79c727f89493db2a49f96e02a19bb20e4cc35eea630472455c013fc1cb604d8
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Accesses Microsoft Outlook profiles
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of SetThreadContext
-
- Target Pago Ofix Gabar $5,217.70.vbs
- Size 1.2MB
- SHA256 14635bbca8f3850c1b1287abd3908e513033580e727e73aa2e51874d5a426f75
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Executes a VBScript file via the Windows Script Host.