Overview

overview

10

Static

static

Swift tran...df.exe

windows7_x64

10

Swift tran...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Swift transferi pdf.exe

  • Size

    1.4MB

  • Sample

    210112-lg76951m5a

  • MD5

    b7f3fc76e71df26b2610742c6343da72

  • SHA1

    e8251404fa0acad1c0c5ddef1c17265e2952d3f2

  • SHA256

    ddb5440189f6a486cae5317df13fd6fa94129941e9aa8a0586bca4c5ed97fb54

  • SHA512

    fd94b2ba6e757cbb09cc01f5d5e7093e9ba131c4d3e5fa492b49a63a9040848e20e42ff982d4b344e5bd8f7037441ac6e5b8a98bceded13b07b5df193e0f1192

Score
10/10
formbookpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.joomlas123.info/n7ak/

Decoy

audereventur.com

huro14.com

wwwjinsha155.com

antiquevendor.com

samuraisoulfood.net

traffic4updates.download

hypersarv.com

rapport-happy-wedding.com

rokutechnosupport.online

allworljob.com

hanaleedossmann.com

kauai-marathon.com

bepbosch.com

kangen-international.com

zoneshopemenowz.com

belviderewrestling.com

ipllink.com

sellingforcreators.com

wwwswty6655.com

qtumboa.com

Targets

    • Target

      Swift transferi pdf.exe

    • Size

      1.4MB

    • MD5

      b7f3fc76e71df26b2610742c6343da72

    • SHA1

      e8251404fa0acad1c0c5ddef1c17265e2952d3f2

    • SHA256

      ddb5440189f6a486cae5317df13fd6fa94129941e9aa8a0586bca4c5ed97fb54

    • SHA512

      fd94b2ba6e757cbb09cc01f5d5e7093e9ba131c4d3e5fa492b49a63a9040848e20e42ff982d4b344e5bd8f7037441ac6e5b8a98bceded13b07b5df193e0f1192

    Score
    10/10
    formbookpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks