Overview

overview

10

Static

static

PO_JAN907#...df.exe

windows7_x64

10

PO_JAN907#...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO_JAN907#092941_BARYSLpdf.exe

  • Size

    928KB

  • Sample

    210118-yqj2kmcqt6

  • MD5

    e24296acfd8c4ec1fb1e5b4b9379be14

  • SHA1

    cdfcde4ab8907b98d3266eb1f80afa43821fb764

  • SHA256

    7139fbd600738d2f456c7f11ae105e45ab0bb6e14a473ae0e68391b8125da393

  • SHA512

    8123f2ab10402f61238d4468c472d23d7cd9788e2f01f3ea8eaf08130a576dad534ebc38329009f54f60ac23b92a26bc792a79426a35c7ac8f964148fa5dd2ac

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.thedilleyo.com/kb8/

Decoy

goodsforbuilders.com

dafuhe.com

parapharmacity.com

montclairymcamotionvibe.com

jamesmccloudart.com

reignfallentertainment.com

couplesforequality.com

pitchbop.com

minipresspaperco.com

venoam.com

so-paradise.com

surgeryprovider.com

donaldscareers.com

disney-funlife.com

biosolo.net

themodsmith.net

grandhawaiian.com

11mountains.com

immatesearch.com

stochastichq.com

Targets

    • Target

      PO_JAN907#092941_BARYSLpdf.exe

    • Size

      928KB

    • MD5

      e24296acfd8c4ec1fb1e5b4b9379be14

    • SHA1

      cdfcde4ab8907b98d3266eb1f80afa43821fb764

    • SHA256

      7139fbd600738d2f456c7f11ae105e45ab0bb6e14a473ae0e68391b8125da393

    • SHA512

      8123f2ab10402f61238d4468c472d23d7cd9788e2f01f3ea8eaf08130a576dad534ebc38329009f54f60ac23b92a26bc792a79426a35c7ac8f964148fa5dd2ac

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks