Severity
Medium
Analysis Summary
A new campaign that uses the Formbook malware, masquerading as an order inquiry through phishing emails.
Initial point of infections sources from a phishing email:
Inside this email is a malicious word document that contains a highly obfuscated macro that once executed launches PowerShell. It then downloads and executes the “cripted.exe” file which is the final stage Formbook malware. PowerShell is also utilized to execute the Microsoft .Net C compiler, to create future code for the malware. Formbook is a notorious information stealer that is available for purchase on underground markets. Many of its capability include:
The malware also includes anti-detection and anti-virus evasion techniques that make it difficult to detect and triage on the infected machine. IBM X-Force IRIS will continue to monitor the campaign and will update this collection if new information becomes available.
Impact
Exposure of sensitive information
Indicators of Compromise
Malware Hash (MD5/SHA1/SH256)
Remediation