Overview

overview

10

Static

static

1

Image001.exe

windows7_x64

10

Image001.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Image001.gz

  • Size

    216KB

  • Sample

    210420-9wbdsh9t2a

  • MD5

    6a9dfc143e74439689cf047f6ac8a6ae

  • SHA1

    86ee4a64b501f0f746c32488d7c115f5073f765c

  • SHA256

    7200e6d6b1dd98a190a8624abee4b4af6794c74e7e13b5bbb0a9302ca79b5800

  • SHA512

    749c92a0ed7c5e07c74654765e9ba1cd1285ed5ff5578b62ea8884d2d5f2d673d7b255780ddb9dd7f767febd68e250c201fe21ba982e7548daa6bcfb496007ca

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.riceandginger.com/fcn/

Decoy

bellee-select.com

unlock-motorola.com

courtneyrunyon.com

hnzywjz.com

retrievingbest.net

ayescarrental.com

beyoutifulblessings.com

heritagediscovery.net

fasoum.com

wbz.xyz

lownak.com

alinkarmay.com

coffeyquiltco.com

validdreamers.com

yuksukcu.club

buildnextfrc.com

avantfarme.com

xyfs360.com

holisticpacific.com

banejia.com

Targets

    • Target

      Image001.exe

    • Size

      231KB

    • MD5

      4ea509c18030b4e71413f2b2bd3b989c

    • SHA1

      5ba34126a4a502bf6e5305c1e647fcf4a7488677

    • SHA256

      c0ebfff80d42551c1a910f2c7b8c08af384e5ccf49c979b7bf664e6c1b731607

    • SHA512

      864dfbe7e07fa4fcf15b487b6c41d20aad5c90d56518f305d8eeb2229ca3e28a9728c2ae5ef4e362d10d7f9a93996f0b67b61e8b5e224b89911152fa1a9db518

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks