Overview

overview

10

Static

static

APR.19.lis...ja.exe

windows7_x64

10

APR.19.lis...ja.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    APR.19.lista e porosive te reja.exe

  • Size

    906KB

  • Sample

    210419-saww85bkpe

  • MD5

    fc079ff271b7d899595dac726f2a97d3

  • SHA1

    b791868359118a324ca421e53de444b3c20b7b9a

  • SHA256

    3e57610037924c21124e91f187f11f45e1d1cc44de45a1d965cd29a92d56f450

  • SHA512

    e798b5788568db00f0512f99a607674770d2f249c9f4723faa9f71c0cc128065ac15b69e069951efa64813f6c889acb47b7775a3421c0b89afa252e71a843075

Score
10/10
formbookpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.joomlas123.info/3nop/

Decoy

bakecakesandmore.com

shenglisuoye.com

chinapopfactory.com

ynlrhd.com

liqourforyou.com

leonqamil.com

meccafon.com

online-marketing-strategie.biz

rbfxi.com

frseyb.info

leyu91.com

hotsmail.today

beepot.tech

dunaemmetmobility.com

sixpenceworkshop.com

incrediblefavorcoaching.com

pofo.info

yanshudaili.com

yellowbrickwedding.com

paintpartyblueprint.com

Targets

    • Target

      APR.19.lista e porosive te reja.exe

    • Size

      906KB

    • MD5

      fc079ff271b7d899595dac726f2a97d3

    • SHA1

      b791868359118a324ca421e53de444b3c20b7b9a

    • SHA256

      3e57610037924c21124e91f187f11f45e1d1cc44de45a1d965cd29a92d56f450

    • SHA512

      e798b5788568db00f0512f99a607674770d2f249c9f4723faa9f71c0cc128065ac15b69e069951efa64813f6c889acb47b7775a3421c0b89afa252e71a843075

    Score
    10/10
    formbookpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks