Overview

overview

10

Static

static

1

Halkbank,d...10.exe

windows7_x64

10

Halkbank,d...10.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Halkbank,doc 00100210210.exe

  • Size

    270KB

  • Sample

    210421-aks7mkksqj

  • MD5

    4744495f286ed57aee218fe035b6d8b5

  • SHA1

    f90d47ed2f471017c913c6e6d5924f38d9a6673c

  • SHA256

    b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f

  • SHA512

    c9b78c243895fdd30a673b045b6b2b5ca0d552490d4c0c005c583ccaa03c42d54df3a7b2e978f169dc9009ff651ea1a4eb8130a9335879c45b95d02f6153e037

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.magnumopuspro.com/nyr/

Decoy

anemone-vintage.com

ironcitytools.com

joshandmatthew.com

breathtakingscenery.photos

karabakh-terror.com

micahelgall.com

entretiendesterrasses.com

mhgholdings.com

blewm.com

sidewalknotary.com

ytrs-elec.com

danhpham.com

ma21cle2henz.xyz

lotusforlease.com

shipleyphotoandfilm.com

bulktool.xyz

ouedzmala.com

yichengvpr.com

connectmygames.com

chjcsc.com

Targets

    • Target

      Halkbank,doc 00100210210.exe

    • Size

      270KB

    • MD5

      4744495f286ed57aee218fe035b6d8b5

    • SHA1

      f90d47ed2f471017c913c6e6d5924f38d9a6673c

    • SHA256

      b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f

    • SHA512

      c9b78c243895fdd30a673b045b6b2b5ca0d552490d4c0c005c583ccaa03c42d54df3a7b2e978f169dc9009ff651ea1a4eb8130a9335879c45b95d02f6153e037

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks