Overview

overview

10

Static

static

1

Halkbank,d...10.exe

windows7_x64

10

Halkbank,d...10.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Halkbank,doc 00100210210.r11

  • Size

    256KB

  • Sample

    210421-zsve9h3zk6

  • MD5

    9a900a84e85e6bfe1ac6e55873aa262a

  • SHA1

    defa759baafd6ba824b55e0387126a8258413cf5

  • SHA256

    256ddf8556d759c829d9ebfb85e2ec242b3bf94d38f2cbf9edfb5c780973a256

  • SHA512

    3c397d4cd7102d199e1e017637fd10a97cea5921c19f8e2a1ae18dd7e5ba9672036780ba8639d3fbce0c509f80396720137400a93f8a283e06710c656d82a331

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.magnumopuspro.com/nyr/

Decoy

anemone-vintage.com

ironcitytools.com

joshandmatthew.com

breathtakingscenery.photos

karabakh-terror.com

micahelgall.com

entretiendesterrasses.com

mhgholdings.com

blewm.com

sidewalknotary.com

ytrs-elec.com

danhpham.com

ma21cle2henz.xyz

lotusforlease.com

shipleyphotoandfilm.com

bulktool.xyz

ouedzmala.com

yichengvpr.com

connectmygames.com

chjcsc.com

Targets

    • Target

      Halkbank,doc 00100210210.exe

    • Size

      270KB

    • MD5

      4744495f286ed57aee218fe035b6d8b5

    • SHA1

      f90d47ed2f471017c913c6e6d5924f38d9a6673c

    • SHA256

      b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f

    • SHA512

      c9b78c243895fdd30a673b045b6b2b5ca0d552490d4c0c005c583ccaa03c42d54df3a7b2e978f169dc9009ff651ea1a4eb8130a9335879c45b95d02f6153e037

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks