Overview

overview

10

Static

static

auricular.exe

windows7_x64

10

auricular.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    auricular.exe

  • Size

    84KB

  • Sample

    210119-gztgq2ywze

  • MD5

    5525bb8a978d3ac15812c8d8ca9b8a57

  • SHA1

    dcb9549ff9c290e056f83639ad546b03206a0806

  • SHA256

    21f49ea6e105c22882a9fb0065803deee18eddb76767a30ddade2e2725eb65d9

  • SHA512

    0e5504ee2fc22ce87c1cac663e0c4cd76227025da20c2903d63ddafc0fc8a270d56a90b89c31d8ee448a61f881ace27037beb623f4409b9d1020a6b2a0a9f35b

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.greatamericapolling.com/71m/

Decoy

heartprintclub.com

artstudio888.com

a2zitsol.com

azarblock.com

designwithravi.com

twoforksbakery.com

fundacionsinlimiteips.com

alephconference.site

smallpeo.com

ingpatrimoine.com

smartpancake.icu

sakiaza.com

hamptoninnbelton.com

captainamericashirts.com

belvederepublishing.com

trollingguide.com

sfgproposal.com

themindofafunnygirl.com

mishkatelm.com

biodis.cloud

Targets

    • Target

      auricular.exe

    • Size

      84KB

    • MD5

      5525bb8a978d3ac15812c8d8ca9b8a57

    • SHA1

      dcb9549ff9c290e056f83639ad546b03206a0806

    • SHA256

      21f49ea6e105c22882a9fb0065803deee18eddb76767a30ddade2e2725eb65d9

    • SHA512

      0e5504ee2fc22ce87c1cac663e0c4cd76227025da20c2903d63ddafc0fc8a270d56a90b89c31d8ee448a61f881ace27037beb623f4409b9d1020a6b2a0a9f35b

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks