Overview

overview

10

Static

static

Piraeus Ba...t_.exe

windows7_x64

10

Piraeus Ba...t_.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Piraeus Bank_swift_.exe

  • Size

    2.2MB

  • Sample

    201125-1g2c8jfqvx

  • MD5

    45e2bbc7c5df2378a2bd2217d6afddf2

  • SHA1

    161bf22fae724e741642bde5b73c458c45a2b0de

  • SHA256

    d54847c7831d92a014c603f004d75828da72ed8f9d270a18023706f1bb375415

  • SHA512

    583a115bcc60d492b5288580124c3ff11f68aeefbe59e713aa770334eebaa98eae81ab4fc29ac996eddbcd1d67c61d6a0e2865f7aa00f765ebcbb7c9709c2399

Score
10/10
formbookmodiloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.joomlas123.info/3nop/

Decoy

bakecakesandmore.com

shenglisuoye.com

chinapopfactory.com

ynlrhd.com

liqourforyou.com

leonqamil.com

meccafon.com

online-marketing-strategie.biz

rbfxi.com

frseyb.info

leyu91.com

hotsmail.today

beepot.tech

dunaemmetmobility.com

sixpenceworkshop.com

incrediblefavorcoaching.com

pofo.info

yanshudaili.com

yellowbrickwedding.com

paintpartyblueprint.com

Targets

    • Target

      Piraeus Bank_swift_.exe

    • Size

      2.2MB

    • MD5

      45e2bbc7c5df2378a2bd2217d6afddf2

    • SHA1

      161bf22fae724e741642bde5b73c458c45a2b0de

    • SHA256

      d54847c7831d92a014c603f004d75828da72ed8f9d270a18023706f1bb375415

    • SHA512

      583a115bcc60d492b5288580124c3ff11f68aeefbe59e713aa770334eebaa98eae81ab4fc29ac996eddbcd1d67c61d6a0e2865f7aa00f765ebcbb7c9709c2399

    Score
    10/10
    formbookmodiloaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Formbook Payload

      rat

    • ModiLoader First Stage

    • Adds policy Run key to start application

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks